BIT-elk-2026-72671

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/elk/BIT-elk-2026-72671.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-elk-2026-72671
Aliases
Published
2026-08-19T08:40:41Z
Modified
2026-09-08T08:47:06Z
Summary
Missing Authorization in Kibana Leading to Unauthorized Modification of Machine Learning Trained Model Space Assignments
Details

A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomaly detection jobs and data frame analytics jobs. A user whose role grants create anomaly detection jobs and data frame analytics jobs without the trained model privilege can therefore remove a trained model from a space. The model itself is not deleted and remains available in its other spaces, and the change can be reversed by a suitably privileged user.

Database specific
{
    "cpes": [
        "cpe:2.3:a:elasticsearch:kibana:*:*:*:*:*:node.js:*:*"
    ],
    "severity": "Medium"
}
References

Affected packages

Bitnami / elk

Package

Name
elk
Purl
pkg:bitnami/elk

Severity

  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
8.0.0
Fixed
8.19.20
Introduced
9.0.0
Fixed
9.4.5

Database specific

source
"https://github.com/bitnami/vulndb/tree/main/data/elk/BIT-elk-2026-72671.json"