CVE-2026-72662: Kibana Authorization Bypass Vulnerability

CVE-2026-72662 Overview

CVE-2026-72662 is an Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in Elastic Kibana. The flaw affects the Timeline feature within Kibana spaces. An authenticated user granted the Timeline feature privilege can enumerate, read, modify, and delete draft Timeline objects belonging to other users in the same space. Read access alone is sufficient for enumeration and disclosure. The Timeline write privilege is required for modification and deletion. Elastic addressed the issue in Kibana 8.19.22 and 9.4.6 through security update ESA-2026-103.

Critical Impact
Authenticated users with Timeline feature privileges can access, alter, or delete other users' draft Timeline objects in the same Kibana space, breaking tenant and user isolation.

Affected Products

Elastic Kibana versions prior to 8.19.22
Elastic Kibana 9.x versions prior to 9.4.6
Kibana deployments where multiple users share a space with Timeline feature privileges

Discovery Timeline

2026-09-26 - CVE-2026-72662 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-72662

Vulnerability Analysis

The vulnerability resides in Kibana's Timeline feature, which stores saved and draft Timeline objects used for security investigations. Kibana enforces feature privileges at the space level, but the Timeline draft object handlers do not verify that the requesting user owns the referenced object. As a result, any authenticated user holding the Timeline feature read privilege within a space can enumerate and read drafts created by other users in that space. Users with the Timeline write privilege can additionally modify or delete those drafts. The flaw undermines per-user object isolation within shared spaces and can expose sensitive investigation context authored by SOC analysts and incident responders.

Root Cause

The root cause is a missing ownership check on user-controlled object identifiers [CWE-639]. The Timeline API accepts a client-supplied key referencing a draft object and returns or mutates the object based on the caller's feature privilege alone. The handler does not compare the draft's owner attribute to the authenticated principal before authorizing the operation.

Attack Vector

Exploitation requires network access to the Kibana instance and authenticated session with the Timeline feature privilege in the target space. No user interaction is required. An attacker enumerates draft Timeline identifiers through the API, then issues read requests to disclose contents. With write privileges, the attacker can send modification or deletion requests against identifiers owned by other users. The attack is executed entirely through the standard Kibana REST interface and does not require administrative privileges.

See the Elastic Security Update ESA-2026-103 for vendor technical details.

Detection Methods for CVE-2026-72662

Indicators of Compromise

Unexpected Kibana audit log entries showing Timeline draft read, update, or delete operations by users who did not author the draft.
Spikes in enumeration-style requests against Timeline draft endpoints from a single authenticated principal.
Missing or altered Timeline drafts reported by analysts who did not perform the change.

Detection Strategies

Enable Kibana audit logging and review events tied to Timeline object access, correlating actor identity against the draft owner field.
Baseline per-user Timeline API usage and alert on access patterns that touch many distinct draft identifiers in a short window.
Hunt for Timeline API calls originating from accounts that historically do not perform investigation work in a given space.

Monitoring Recommendations

Forward Kibana audit logs to a centralized SIEM for correlation with authentication and session telemetry.
Monitor for privilege grants that add the Timeline feature privilege to accounts outside the security operations team.
Track anomalous volumes of HTTP requests against Timeline draft endpoints and alert on deviations.

How to Mitigate CVE-2026-72662

Immediate Actions Required

Upgrade Kibana to version 8.19.22 or 9.4.6, which contain the fix delivered in ESA-2026-103.
Review space membership and remove the Timeline feature privilege from accounts that do not require it.
Audit existing Timeline drafts for unexpected modifications or deletions prior to patching.

Patch Information

Elastic released fixed versions 8.19.22 and 9.4.6 under security advisory ESA-2026-103. Operators should plan upgrades following standard Kibana upgrade procedures. Full remediation details are published in the Elastic Security Update ESA-2026-103.

Workarounds

Restrict the Timeline feature privilege to a minimal set of trusted users until patching is complete.
Separate users into distinct Kibana spaces so that Timeline drafts are not shared across sensitive teams.
Increase audit logging verbosity on Timeline endpoints to detect misuse during the exposure window.

bash

# Verify Kibana version after upgrade
curl -s -u <user>:<pass> https://<kibana-host>:5601/api/status | jq '.version.number'

# Expected output: 8.19.22 or 9.4.6 (or later)