# CVE-2026-72672: Incorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event Data

> CVE-2026-72672: Incorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event Data. CVSS 7.7 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-72672
Last updated: 2026-09-04T20:20:14Z

- Published: 2026-08-13 19:11 UTC · Updated: 2026-09-04 20:20 UTC · Assigner: elastic
- CVSS: 7.7 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- EPSS: 0.37%, 31th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-863

## Description

The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the caller's Elasticsearch index privileges are not. An authenticated user who holds Elastic Security feature privileges but no read access to the Elastic Defend event indices can therefore retrieve field values from that data, including process command line arguments, which commonly contain tokens, credentials, connection strings, and other sensitive operational detail from protected hosts.

## Affected vendors and products

- Elastic: Kibana

## Tracked companies

- [Elastic Cloud](https://rewindex.com/company/elastic-cloud.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-72672)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-72672)
- [https://discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-89/389536](https://discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-89/389536)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-72672 · Markdown: https://rewindex.com/cve/CVE-2026-72672.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-72672 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:12:03.190Z