Elastic Kibana CVE-2026-72655

Exploitation requires an authenticated Kibana user account with at least view-level permissions on the Elastic Security case management feature - the account must have read access to cases but lack explicit case-editing privileges. The Elastic Security application must be deployed and the case management feature must be in active use. The attacker must interact directly with the Kibana REST API (not the UI), requiring knowledge of the API endpoint structure and a valid authentication token (session cookie or API key). Exploitation is limited by: mandatory authentication (PR:L - unauthenticated access is not possible), scope is unchanged (no lateral movement or system-level access), and impact is confined to integrity of case data only - no code execution, credential theft, or service disruption is achievable through this vector alone. Non-default configuration is not required; any standard Kibana deployment with Elastic Security cases enabled is susceptible.

The CVSS 3.1 score of 4.3 Medium (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) accurately characterizes the limited blast radius: exploitation requires a valid authenticated session (PR:L), yields only low integrity impact on case records (I:L), and has no confidentiality or availability dimension. No EPSS data was supplied in the source intelligence, so exploitation probability cannot be quantified numerically. The vulnerability is not listed in CISA KEV, and no POC code has been identified, indicating no confirmed active exploitation at analysis time. Despite the low CVSS score, real-world risk is elevated for organizations using Kibana's case management feature as part of a SOC workflow - an adversary who compromises a low-privilege analyst account could silently alter incident records, tamper with case evidence, or close active investigations, undermining security operations integrity without triggering availability or confidentiality alerts. The network-accessible attack vector with no user interaction required (UI:N) and low complexity (AC:L) means exploitation does not require sophisticated targeting. The primary limiting factor is the mandatory authentication requirement - unauthenticated exploitation is not possible.

An authenticated Kibana analyst with view-only access to security cases crafts a direct HTTP PATCH or PUT request to the case management REST API, including object attributes (such as case status, assignee, title, or tags) that the UI does not expose to view-only users. Because the API does not enforce the same role-based authorization checks as the UI, the request succeeds and the case record is modified. No public proof-of-concept exists, but the technique requires only knowledge of the Kibana API schema (publicly documented by Elastic) and a valid session token.