Missing Authorization Vulnerability in Kibana by Elastic

CVE-2026-72675

What is CVE-2026-72675?

A missing authorization vulnerability in Kibana can result in cross-space information disclosure and unauthorized data modifications. The issue arises due to the improper implementation of a space filter, which is intended to segregate machine learning data across different spaces within a deployment. This flaw allows operations from one space to affect the machine learning data of all other spaces due to elevated internal permissions adopted by Kibana Machine Learning. As a consequence, sensitive information can be inadvertently exposed or altered without appropriate authorization.

References