PrivacyHigh
CVE-2026-78598: Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information dis…
- Occurred
- Sep 2, 2026
- Published
- Sep 2, 2026
- Source
- NVD CVE
Summary
Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding machine learning job management privileges within a single Kibana space could cause a job's saved object to become accessible across all spaces in the Kibana instance, without holding access rights to those additional spaces.
Tags
- CVE
- CVE-2026-78598
- cvss:MEDIUM
Classification
Category confidence: 90%
Severity confidence: 85%
Rationale: CVE describes incorrect authorization leading to unauthorized information disclosure across Kibana spaces.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8