CVE details
CVE-2026-78606
Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two authenticated principals originating from different authentication realms share the same username value, one could read, modify, and delete the other's private Elastic AI Assistant Knowledge Base entries.
- Score
- 4.2 medium
- Published
- 2026-09-01
- Links
- NVD · cve.org · Report wrong data
Matched ports (4)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| textproc/kibana93 | kibana93 | 9.3.8 | possibly backported | elastic@FreeBSD.org |
| textproc/kibana8 | kibana8 | 8.19.21 | fixed by update | elastic@FreeBSD.org |
| textproc/kibana94 | kibana94 | 9.4.7 | fixed by update | elastic@FreeBSD.org |
| textproc/kibana95 | kibana95 | 9.5.4 | fixed by update | elastic@FreeBSD.org |