CVE-2026-56146
MEDIUM
NVD
CVSS Score
5.4
Severity
MEDIUM
Published
Jul 21, 2026
Vendor
unknown
Description
Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated user with read-only Security Solution access could perform write operations on watchlist data that should require elevated privileges. Under specific deployment conditions, this could also allow such a user to access data beyond their authorized scope.