{"id":"CVE-2026-78581","aliases":["BIT-elk-2026-78581","BIT-kibana-2026-78581","EUVD-2026-65489","GHSA-623v-mjrc-8wr7"],"status":"published","title":"Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana","description":"Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier to access or modify a conversation they do not own. Successful exploitation requires knowledge of a hard-to-guess identifier.","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00203,"percentile":0.10357,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-639"],"published":"2026-08-25T13:08:11Z","modified":"2026-10-28T11:17:57Z","fixes":[{"ecosystem":"Bitnami","package":"elk","fixed_in":["8.16.3","8.17.2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"kibana","fixed_in":["8.16.3","8.17.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"elk","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.16.3"},{"introduced":"8.17.0"},{"fixed":"8.17.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"kibana","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.16.3"},{"introduced":"8.17.0"},{"fixed":"8.17.2"}]}]}],"products":[{"vendor":"elastic","product":"kibana"}],"references":[{"url":"https://discuss.elastic.co/t/kibana-8-16-3-8-17-2-security-update-esa-2026-51/387446","tags":["Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78581","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-623v-mjrc-8wr7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78581.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-78581","title":"Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana","description":"Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier to access or modify a conversation they do not own. Successful exploitation requires knowledge of a hard-to-guess identifier.","status":"published","published":"2026-08-25T13:08:11.52Z","modified":"2026-08-25T14:51:53.897Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T13:34:48.658051Z"}],"euvd":[{"id":"EUVD-2026-65489","description":"Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier to access or modify a conversation they do not own. Successful exploitation requires knowledge of a hard-to-guess identifier.","status":"published","published":"2026-08-25T13:08:11Z","modified":"2026-08-25T14:51:53Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:32.944243Z"}],"ghsa":[{"id":"GHSA-623v-mjrc-8wr7","title":"Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized...","description":"Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier to access or modify a conversation they do not own. Successful exploitation requires knowledge of a hard-to-guess identifier.","status":"published","published":"2026-08-25T15:32:58Z","modified":"2026-08-25T15:33:06Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:10:57.434403Z"}],"nvd":[{"id":"CVE-2026-78581","description":"Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier to access or modify a conversation they do not own. Successful exploitation requires knowledge of a hard-to-guess identifier.","status":"published","published":"2026-08-25T13:19:31.12Z","modified":"2026-09-02T14:10:03.667Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:12:41.347728Z"}],"osv":[{"id":"CVE-2026-78581","title":"Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana","description":"Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier to access or modify a conversation they do not own. Successful exploitation requires knowledge of a hard-to-guess identifier.","status":"published","published":"2026-08-25T13:08:11.52Z","modified":"2026-10-28T11:17:57.405410116Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:45:17.44708Z"},{"id":"BIT-elk-2026-78581","title":"Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana","description":"Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier to access or modify a conversation they do not own. Successful exploitation requires knowledge of a hard-to-guess identifier.","status":"published","published":"2026-08-31T05:41:10.306Z","modified":"2026-09-08T08:47:08.789647185Z","updated_at":"2026-11-02T15:28:29.563843Z"},{"id":"BIT-kibana-2026-78581","title":"Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana","description":"Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier to access or modify a conversation they do not own. Successful exploitation requires knowledge of a hard-to-guess identifier.","status":"published","published":"2026-08-31T05:47:28.878Z","modified":"2026-09-08T08:48:08.271506661Z","updated_at":"2026-11-02T15:28:32.162822Z"}]}}