Skip to content
Sign in
5.3 Medium

CVE-2026-56152 Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized information disclosure via Accessing…

Description

Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, a low-privileged authenticated user can access response action data that they are not authorized to view.

Affected products and versions

Product Affected versions Fixed in
Elastic Defend 9.3 9.3.0 → 9.3.1 No fix stated
Elastic Defend 9.0 9.0.0 → 9.2.6 No fix stated
Elastic Defend 8.6 8.6.0 → 8.19.12 No fix stated
Kibana 9.3 9.3.0 → 9.3.1 No fix stated
Kibana 9.0 9.0.0 → 9.2.6 No fix stated
Kibana 8.6 8.6.0 → 8.19.12 No fix stated

Other CVEs of Elastic Defend

The 3 CVEs of Elastic Defend →
CVE-2025-25013 Improper restriction of environment variables in Elastic Defend can lead to exposure of sensitive information such as… 6.5 Medium CVE-2024-37284 Improper handling of alternate encoding occurs when Elastic Defend on Windows systems attempts to scan a file or process… 5.5 Medium
Track this CVE