CVE-2026-72662

Name of the Vulnerable Software and Affected Versions Kibana (affected versions not specified)

Description An authorization bypass exists where an authenticated user with Timeline feature privileges in a Kibana space can access draft Timeline objects belonging to other users within the same space. This occurs because functionality is not properly constrained by Access Control Lists (ACLs), which are sets of rules that define which users or system processes are granted access to objects. Users with read access can enumerate and disclose data, while those with write privileges can modify or delete these objects.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.