Medium severity5.3NVD Advisory· Published Jul 1, 2026· Updated Sep 4, 2026

CVE-2026-56152

Description

Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, a low-privileged authenticated user can access response action data that they are not authorized to view.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Elastic/Kibanallm-fuzzy
Elastic/Endpoint Security
cpe:2.3:a:elastic:endpoint_security:*:*:*:*:*:*:*:*
Range: >=8.6.0,<8.19.13

Patches

Vulnerability mechanics

References

discuss.elastic.co/t/kibana-8-19-13-9-2-7-9-3-2-security-update-esa-2026-46/387443nvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000