CVEvulnerability

CVE-2026-72669

7.6 HIGH Published 2026-08-13 Modified 2026-09-04 Official page ↗
Status
Analyzed
Published
2026-08-13
Last modified
2026-09-04
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.6 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Weaknesses
CWE-862

Description

The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flows of other users, read their onboarding state, and write arbitrary progress data into them. A tampered flow can also cause the owner's onboarding view to fail with a server error.

Affected configurations

• elastic kibana (>= 8.9.0 < 8.19.19) • elastic kibana (>= 9.0.0 < 9.4.5)

Related

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References