CVE-2026-72633

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-72633
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72633.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-72633
Downstream
Published
2026-09-01T19:20:25.334Z
Modified
2026-09-06T08:14:57.057742Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring
Details

Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only read-level Security feature access, and no Elasticsearch privileges, could stop the recurring Privilege Monitoring engine task for a Kibana space. Privileged user monitoring then stops producing data for that space while the engine continues to report a healthy state to operators.

Database specific 
{
    "cwe_ids": [
        "CWE-863"
    ],
    "cna_assigner": "elastic",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "9.1.0"
                },
                {
                    "last_affected": "9.4.5"
                },
                {
                    "introduced": "9.5.0"
                },
                {
                    "last_affected": "9.5.1"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72633.json"
}
References

Affected packages

Git / github.com/elastic/elasticsearch

Affected ranges

Type
GIT
Repo
https://github.com/elastic/elasticsearch
Events
Introduced
00e7d33bf08f1476229d9d1642e2da46cfebdd53
Fixed
10011cbc74640115d0ffac0cef7c925aec4754f5
Introduced
8d4246a64bc255212407b1b313fe402391299c88
Fixed
b42549c72e6e040825b13e5d8ebf7ff63886b24d
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "9.1.0"
        },
        {
            "fixed": "9.4.6"
        },
        {
            "introduced": "9.5.0"
        },
        {
            "fixed": "9.5.2"
        }
    ]
}

Affected versions

v9.*
v9.5.0
v9.5.1

Database specific

vanir_signatures 
[
    {
        "target": {
            "file": "server/src/test/java/org/elasticsearch/index/codec/vectors/cluster/AbstractHierarchicalKMeansTestCase.java"
        },
        "deprecated": false,
        "id": "CVE-2026-72633-3a7783ac",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "135052021381586703096475745787625846996",
                "165211593863699318769248196974601346783",
                "93283623091379418506488785897504512678",
                "26545141423582351670471289194004966592",
                "163657208054960210006054837373388252834",
                "188328033067523928975545214353316183280",
                "153861657743628462836102004850948745595",
                "282921420759628815169960595602566628382",
                "184573602202713091021972066972167860338",
                "29811076932042013910743558499223285624",
                "329060869068124202993854269015822909644",
                "208674098823385167178952187573268393324",
                "1790912059330226764817107183308278790",
                "250365171868249734159749096023348060987",
                "234287526282356732701761841793171567069",
                "198382026650527638707696153454227455590",
                "22314971617461182915801831963963349651",
                "248670988213692025743293766177521538469",
                "299527711206142555017430246441389624918",
                "314424171940312354540151943636534635821",
                "319894074297006831531250284074733644972",
                "300706329898922335316402366566757043028",
                "170031952266079495757137241821007859830",
                "49997997141269201607740040473519105167",
                "20985465904923486259211109010184634164",
                "242167330276683098608140382844566776966",
                "33950566296750829192802020892327850413",
                "176192876017832838873773101418201333563",
                "284423169205913515477596337728676329506",
                "20850313955169809489168194826791412330",
                "333903305963961335898124161710482880456",
                "271796563581059297781225176288220860800",
                "33208540788650055032930896198457671125",
                "282006514390693352268708910181525894168",
                "169451357934179425439211439538890303504",
                "278107203642233221015714977264129937095",
                "260053361466461183187753394988690923594",
                "165485295842040287002401864914731593811",
                "120069717387387360263135575602180210321"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "source": "https://github.com/elastic/elasticsearch/commit/b42549c72e6e040825b13e5d8ebf7ff63886b24d"
    },
    {
        "target": {
            "file": "server/src/test/java/org/elasticsearch/index/codec/vectors/cluster/AbstractHierarchicalKMeansTestCase.java",
            "function": "testHKmeans"
        },
        "deprecated": false,
        "id": "CVE-2026-72633-dccf863f",
        "signature_version": "v1",
        "digest": {
            "function_hash": "73696363205630521427229600524674962584",
            "length": 1318.0
        },
        "signature_type": "Function",
        "source": "https://github.com/elastic/elasticsearch/commit/b42549c72e6e040825b13e5d8ebf7ff63886b24d"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72633.json"
vanir_signatures_modified 
"2026-09-06T08:14:57Z"

Git / github.com/elastic/kibana

Affected ranges

Type
GIT
Repo
https://github.com/elastic/kibana
Events
Introduced
9f30374092edd41719399f7ef81cb7ae78d8a3ab
Fixed
692551ad493ed71169e295e2160446428ee00b15
Introduced
240f7d17d21408117f4295bcf74d48092ab0d078
Fixed
37dc1e9d6dbf80bb1cf22da5ed258d3f642d2f9c
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "9.1.0"
        },
        {
            "fixed": "9.4.6"
        },
        {
            "introduced": "9.5.0"
        },
        {
            "fixed": "9.5.2"
        }
    ]
}

Affected versions

v9.*
v9.5.0
v9.5.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72633.json"