Is CVE-2026-78606 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-78606?

CVE-2026-78606 has a CVSS v3 severity of MEDIUM (4.2).

Back

CVE-2026-78606

Description

Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two authenticated principals originating from different authentication realms share the same username value, one could read, modify, and delete the other's private Elastic AI Assistant Knowledge Base entries.