Authorization Bypass Vulnerability in Kibana by Elastic

CVE-2026-72650

What is CVE-2026-72650?

An authorization bypass vulnerability in Kibana allows authenticated users to gain unauthorized access to sensitive telemetry data. Users with permission to read alerting rules in a specific Kibana space can exploit this vulnerability to access execution telemetry related to alerting rules in other spaces they do not have rights to view. This potentially exposes sensitive information, including rule identifiers, names, execution outcomes, and timestamps, which could lead to further security risks within the application.

References