Authorization Bypass Vulnerability in Kibana by Elastic

CVE-2026-72662

What is CVE-2026-72662?

In Kibana, a vulnerability allows authenticated users with Timeline feature privileges to gain unauthorized access to draft Timeline objects of other users within the same space. This occurs through inadequate Access Control Lists (ACLs), enabling affected users to enumerate, read, modify, and delete data they should not have access to. Users with only read access can exploit this for data enumeration and disclosure, while a write privilege is essential for modifications and deletions.

References