CVE-2026-72655

Name of the Vulnerable Software and Affected Versions Kibana (affected versions not specified)

Description Improperly Controlled Modification of Dynamically-Determined Object Attributes in the case management functionality of Elastic Security in Kibana allows an authenticated user without case editing privileges to unauthorizedly modify case data. This occurs because object attributes accepted by the case management API do not have the same authorization enforcement as the user interface, enabling low-privileged users to alter case records they are only permitted to view by manipulating user-controlled variables.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.