CVE-2026-78603
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Sep 01, 2026
Vendor
unknown
Description
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding minimal Elasticsearch privileges could bypass Kibana feature authorization and space access controls, resulting in the unauthorized disclosure of Fleet deployment metadata from the default Kibana space.