{"id":"CVE-2026-78597","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-78597","generatedAt":"2026-10-28T09:42:22.495Z","title":"Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1).","description":"Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only low-privilege Security feature access could invoke an administrative operation that creates and persists Elasticsearch API keys under the caller's identity, bypassing the elevated cluster and Kibana privileges that the documented Entity Store setup flow requires.","published":"2026-09-01T20:17:24.000Z","lastModified":"2026-09-02T18:50:49.000Z","status":"Analyzed","sourceIdentifier":"security@elastic.co","cvss":{"version":"3.1","score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},"cwe":["CWE-862"],"affected":["elastic/kibana"],"epss":{"score":0.00287,"percentile":0.2106,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.29%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-security-update-esa-2026-155/390072","tags":["Vendor Advisory"],"source":"security@elastic.co"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-78597","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}