CVEvulnerability

CVE-2026-72658

7.3 HIGH Published 2026-08-13 Modified 2026-09-02 Official page ↗
Status
Analyzed
Published
2026-08-13
Last modified
2026-09-02
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.3 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Weaknesses
CWE-352

Description

Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issued to Kibana in the context of the viewing user's session.

Affected configurations

• elastic kibana (>= 8.0.0 < 8.19.20) • elastic kibana (>= 9.0.0 < 9.4.5)

Related

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References