Vulnerabilities CVE-2026-72658

CVE-2026-72658

High

Open

TLP:CLEAR

Cross-Site Request Forgery in Kibana Leading to Privilege Escalation

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issued to Kibana in the context of the viewing user's session.

Details

CVSS Score: 7.3
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Confidence: 90%
Published: Aug 13, 2026
Last Modified: Aug 14, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.