Kibana CVE-2026-72661

Exploitation requires a valid authenticated Kibana session - the CVSS vector PR:L confirms that low-privilege credentials are sufficient and no elevated account is needed. The attacker does NOT need Security Solution privileges, endpoint response action privileges, or any Elasticsearch index-level privileges on the underlying data. The vulnerability is specific to the internal data retrieval capability backing Elastic Defend endpoint response actions; Kibana deployments that do not use Elastic Defend or have no enrolled managed endpoints will have no sensitive endpoint response data to disclose, reducing practical impact to near zero in those environments. Exploitation is bounded to reading endpoint response action records and host response content - no write, delete, command execution, or lateral movement capability is exposed. No user interaction is required beyond the attacker possessing their own valid Kibana account.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects a network-exploitable, low-complexity authorization bypass requiring only a valid low-privileged account with no special configuration or user interaction needed. The confidentiality impact is rated High because endpoint response action records may contain sensitive forensic artifacts, host command outputs, and security telemetry returned from managed endpoints - data that defenders explicitly intended to restrict. No EPSS score was provided in available intelligence, so exploitation probability cannot be quantified from that signal. No KEV listing and no public POC exist at time of analysis, suggesting exploitation is theoretical or unreported. The barrier to exploitation is low for any Kibana account holder, making this a meaningful real priority in multi-tenant or shared Kibana deployments where privilege separation between Security analysts and general users is a key architectural assumption - the vulnerability directly undermines that model. S:U (no scope change) is consistent with impact being limited to Kibana-managed endpoint data rather than broader Elasticsearch index access or direct host compromise.

An authenticated Kibana user holding only a low-privilege reporting or developer role - with no Security Solution, endpoint, or Elasticsearch index privileges - directly calls the internal endpoint response action data retrieval API with their valid session token. The internal service processes the request with its own elevated permissions rather than validating the caller's role assignments, returning endpoint response action records and host-returned forensic content the user is explicitly unauthorized to see. No public exploit code is identified at time of analysis, but the exploit requires only knowledge of the internal API path and a valid Kibana session token.