Missing Authorization in Kibana Leading to Unauthorized Elasticsearch Index Data Exposure
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kibana privileges to indirectly cause a background task to read from Elasticsearch indices that user is not authorized to access. Derived entity data from those indices is then exposed through the entity store output.
Affected Versions:
- 9.x: All versions from 9.4.0 up to and including 9.4.4
Versions prior to 9.4.0, including all 8.x releases, are not affected because the affected functionality did not exist.
Affected Configurations:
The vulnerability affects Kibana deployments that meet all of the following conditions: a Platinum or higher subscription (or equivalent trial license) is active; the Entity Store v2 feature has been enabled by an administrator; and the Entity Store has been installed at least once. Deployments where these conditions are not all met are not affected.
Solutions and Mitigations:
The issue is resolved in Kibana version 9.4.5.
For Users that Cannot Upgrade:
There are no workarounds for this vulnerability.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.
Severity: CVSSv3.1: Medium ( 5.5 ) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
CVE ID: CVE-2026-78601
Problem Type: CWE-862 - Missing Authorization
Impact: CAPEC-122 - Privilege Abuse