CVE-2026-56146 — Improper Access Control in Kibana Leading to Unauthorized Data Modification and Information Disclosure
Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privile…
Published: 2026-07-21 · CVSS: 5.4 · CVSS 3.1
Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated user with read-only Security Solution access could perform write operations on watchlist data that should require elevated privileges. Under specific deployment conditions, this could also allow such a user to access data beyond their authorized scope.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7