What is the CVSS score of CVE-2026-56146?

CVE-2026-56146 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Elastic Kibana CVE-2026-56146

EUVD-2026-46396 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-21 elastic

GHSA-qmwg-877r-54mc

Authentication Bypass Information Disclosure Elastic Kibana

5.4

CVSS 3.1 · Vendor: elastic

Severity by source

Vendor (elastic) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-reachable API endpoint requires low-privileged credentials (PR:L); limited confidentiality and integrity impact match unauthorized read and write scope; no availability impact described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (elastic).

CVSS VectorVendor: elastic

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 20:40 vuln.today

CVE Published

Jul 21, 2026 - 20:09 cve.org

MEDIUM 5.4

DescriptionCVE.org

Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated user with read-only Security Solution access could perform write operations on watchlist data that should require elevated privileges. Under specific deployment conditions, this could also allow such a user to access data beyond their authorized scope.

AnalysisAI

Incorrect Authorization (CWE-863) in Kibana's Entity Analytics Watchlist feature allows low-privileged authenticated users with read-only Security Solution access to perform unauthorized write operations against watchlist configuration endpoints that should require elevated privileges. The CVSS 5.4 vector (AV:N/AC:L/PR:L/UI:N) confirms network-exploitable but credential-gated exploitation with limited confidentiality and integrity impact; under specific deployment conditions, affected users may additionally access data outside their authorized scope. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Technical ContextAI

Kibana is the browser-based analytics and visualization front end for the Elastic Stack, and its Security Solution includes an Entity Analytics module used for threat detection and investigation. The Entity Analytics Watchlist is a configuration surface that tracks entities of interest for security teams. The root cause, CWE-863 (Incorrect Authorization), indicates that authorization logic is present but incorrectly evaluated - the application grants access based on insufficient privilege checks, allowing a read-only Security Solution role to pass authorization gates intended only for write-privileged roles. The CPE string cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:* covers all Kibana versions with no lower-bound restriction, though the vendor advisory references Kibana 9.4.3 as the patched release. The description also references CWE-284 (Improper Access Control), which is a parent class; CWE-863 is the more precise classification and consistent with the described behavior.

RemediationAI

Upgrade Kibana to version 9.4.3 or later, as confirmed by Elastic's security advisory ESA-2026-58 at https://discuss.elastic.co/t/kibana-9-4-3-security-update-esa-2026-58/388557. No official workaround is described in the available intelligence. As a compensating control pending upgrade, administrators should audit Kibana role assignments and restrict Security Solution access to only personnel who require it, reducing the pool of users who could exploit the misconfigured authorization check - note that this does not eliminate the flaw but limits exposure. Organizations with strict data-isolation requirements between Security Solution users should treat this as higher priority until patched, since the information disclosure component may undermine RBAC-based access boundaries under specific deployment configurations.