CVE-2026-72658
HIGH
NVD
CVSS Score
7.3
Severity
HIGH
Published
Aug 13, 2026
Vendor
unknown
Description
Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issued to Kibana in the context of the viewing user's session.