EUVD-2026-41087
GHSA-vvj5-p4vc-v5q3
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable via Kibana API, but AC:H reflects undisclosed prerequisite conditions; PR:L confirmed by description; confidentiality-only impact with no integrity or availability effect.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
1DescriptionCVE.org
Incorrect Authorization (CWE-863) in Elastic Defend can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, a low-privileged authenticated user can access response action data that they are not authorized to view.
AnalysisAI
Incorrect Authorization (CWE-863) in Elastic Defend exposes response action data to low-privileged authenticated users who should not have access to it. The flaw, classified under CAPEC-1, arises because access controls on specific functionality are not properly enforced, allowing a user with minimal privileges to read security response action data belonging to other users or roles. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, but the High confidentiality impact (CVSS C:H) means sensitive endpoint response data - such as isolation actions, process kills, or file retrieval outputs - could be disclosed.
Technical ContextAI
Elastic Defend is Elastic's endpoint detection and response (EDR) agent, part of the Elastic Security platform. It integrates with Elasticsearch and Kibana to collect telemetry, enforce security policies, and execute response actions such as host isolation, process termination, and file retrieval. CWE-863 (Incorrect Authorization) indicates the application performs authentication but fails to correctly verify whether the authenticated user has the right authorization for the specific resource or action being accessed - in this case, response action result data. This maps to CAPEC-1, where access controls on a feature or data set are insufficiently constrained, allowing access via a path that bypasses the intended ACL model. The vulnerability is reachable over the network, consistent with Kibana's web-based API surface through which response action data is exposed.
RemediationAI
The primary remediation is to upgrade Elastic Defend to the fixed version(s) identified in Elastic Security Advisory ESA-2026-46, available at https://discuss.elastic.co/t/elastic-defend-8-19-13-9-2-7-9-3-2-security-update-esa-2026-46. Based on the advisory URL slug, fixed releases appear to correspond to versions in the 8.19, 13.9.2, and 7.9.3.2 lines, but exact patch version numbers should be confirmed directly from the advisory page. As a compensating control prior to patching, administrators should audit role-based access control (RBAC) assignments in Kibana and restrict response action visibility to only those users and roles that operationally require it, using Elastic's built-in privilege model. Reducing the number of low-privileged accounts with authenticated Kibana access limits exposure. No patch version was independently confirmed from the provided input data - consult the vendor advisory directly for authoritative version guidance.
More in Endpoint Security
View allLocal privilege escalation vulnerability potentially allowed an attacker to misuse ESET’s file operations to delete file
Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH lo
A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security clien
The ESET Personal Firewall NDIS filter (EpFwNdis.sys) driver in the Firewall Module Build 1183 (20140214) and earlier in
The esets_daemon service in ESET Endpoint Antivirus for macOS before 6.4.168.0 and Endpoint Security for macOS before 6.
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in the UpdateServer compone
An Incorrect Regular Expression vulnerability in Bitdefender GravityZone Update Server allows an attacker to cause a Ser
Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security with antivirus databases released before 12 March
Stormshield Endpoint Security before 2.1.2 allows remote code execution. Rated critical severity (CVSS 9.8), this vulner
The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before 1.1.0.161, Agent (MA) 5.x before 5.0.
Cross Site Request Forgery vulnerability in the firewall ePO extension of McAfee Endpoint Security (ENS) prior to 10.7.0
Improper Access Control vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2020 Updat
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today