# CVE-2026-72655: Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification

> CVE-2026-72655: Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification. CVSS 4.3 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-72655
Last updated: 2026-09-04T20:16:54Z

- Published: 2026-08-13 19:13 UTC · Updated: 2026-09-04 20:16 UTC · Assigner: elastic
- CVSS: 4.3 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- EPSS: 0.31%, 23th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-915

## Description

Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of case data by an authenticated user who has not been granted case editing privileges, via Manipulating User-Controlled Variables (CAPEC-77). Object attributes accepted by the case management API were not subject to the same authorization enforcement applied in the user interface, so a low-privileged user could alter case records they were only entitled to view.

## Affected vendors and products

- Elastic: Kibana

## Tracked companies

- [Elastic Cloud](https://rewindex.com/company/elastic-cloud.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-72655)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-72655)
- [https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-security-update-esa-2026-110/389523](https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-security-update-esa-2026-110/389523)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-72655 · Markdown: https://rewindex.com/cve/CVE-2026-72655.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-72655 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:12:45.079Z