CVE-2026-78601

Name of the Vulnerable Software and Affected Versions Kibana (affected versions not specified)

Description An authorization control is missing in a Kibana Entity Store configuration operation. This allows an authenticated user with elevated privileges to indirectly trigger a background task to read from Elasticsearch indices they are not authorized to access. Consequently, derived entity data from these indices is exposed through the entity store output, leading to information disclosure via privilege abuse.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.