What is the CVSS score of EUVD-2026-58275?

EUVD-2026-58275 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Kibana EUVD-2026-58275

| CVE-2026-72650 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-13 elastic

GHSA-hcx4-m35m-r7xm

Authentication Bypass Information Disclosure Elastic Kibana

4.3

CVSS 3.1 · Vendor: elastic

Severity by source

Vendor (elastic) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible exploitation requires only low-privilege authentication; impact is limited to partial confidentiality of metadata with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (elastic).

CVSS VectorVendor: elastic

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 20:11 vuln.today

CVE Published

Aug 13, 2026 - 19:13 cve.org

MEDIUM 4.3

DescriptionCVE.org

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user who is authorized to read alerting rules in a single Kibana space could retrieve alerting rule execution telemetry that belongs to spaces the user is not authorized to access. The disclosed telemetry includes rule identifiers, rule names, space identifiers, execution outcomes, timestamps, and execution counters.

AnalysisAI

Cross-space alerting rule telemetry disclosure in Kibana allows an authenticated user with read access to alerting rules in one Kibana space to retrieve execution telemetry belonging to other spaces they are not authorized to access. The exposed metadata includes rule identifiers, rule names, space identifiers, execution outcomes, timestamps, and execution counters - a meaningful control gap for organizations using Kibana Spaces for multi-tenant or departmental isolation. Fixes are available in Kibana 8.19.20 and 9.4.5 per Elastic advisory ESA-2026-105; no public exploit or CISA KEV listing exists at time of analysis.

Technical ContextAI

Kibana's Spaces feature provides logical multi-tenancy, isolating dashboards, saved objects, alerting rules, and related data between teams or organizational units. The alerting rule execution telemetry subsystem fails to re-validate the caller's space-level authorization when processing telemetry retrieval requests - a textbook CWE-639 (Authorization Bypass Through User-Controlled Key) flaw. The user supplies a key (space or rule identifier) that the application trusts without confirming the caller holds read rights to that space. This maps directly to CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs): the ACL check enforced for standard alerting rule reads within a user's authorized space is absent on the telemetry retrieval code path. The affected product is identified by CPE cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*, indicating the wildcard version range covers all current Kibana releases.

RemediationAI

Upgrade Kibana to version 8.19.20 (on the 8.x track) or 9.4.5 (on the 9.x track), as detailed in Elastic security advisory ESA-2026-105 at https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-105/389521. If immediate patching is not possible, the most effective compensating control is to audit and restrict alerting rule read permissions: revoke that permission from any user or role that does not explicitly require it, reducing the pool of principals who could exploit cross-space telemetry access. Additionally, enforcing network-layer access controls to limit Kibana exposure to trusted internal networks or VPN segments narrows the attack surface for externally reachable deployments, though this does not remediate the authorization flaw for authenticated internal users. Single-space Kibana deployments with no tenant isolation requirement have negligible practical exposure.