CVE-2026-72658 — Cross-Site Request Forgery in Kibana Leading to Privilege Escalation
Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can s…
Published: 2026-08-13 · CVSS: 7.3 · CVSS 3.1
Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issued to Kibana in the context of the viewing user's session.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7