CVE-2026-72630 in Kibana
Summary
by MITRE • 08/13/2026
Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing integration policies for one specific integration. When an existing integration policy was updated, that restriction was evaluated against the integration recorded on the stored policy rather than against the replacement integration supplied with the update. An authenticated user holding only the Elastic Defend endpoint policy management privilege was therefore able to convert an endpoint policy they administer into a policy for a different integration, and to supply that integration's configuration at the same time.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability described represents a critical authorization flaw classified as CWE-863 Incorrect Authorization within the Kibana Fleet component of Elastic Stack. This weakness stems from improper validation of user privileges during integration policy updates, creating a privilege escalation vector that directly violates fundamental security principles of access control. The flaw manifests when the system evaluates authorization restrictions against stored policy data rather than the actual integration being updated, allowing unauthorized privilege expansion through what should be controlled administrative operations.
This vulnerability operates through a specific operational pathway that aligns with CAPEC-122 Privilege Abuse pattern where an authenticated user with limited permissions can manipulate system state to gain broader access. The affected component specifically targets endpoint policy management within the Elastic Defend integration, where users holding only the basic endpoint policy management role could exploit this flaw to convert their administered policies into configurations for entirely different integrations. The technical implementation error occurs during policy update operations where the system fails to validate that the user has authorization rights for the replacement integration type being applied.
The operational impact of this vulnerability extends beyond simple privilege escalation as it enables attackers to potentially gain access to sensitive configuration data and administrative capabilities associated with different integration types. An authenticated user could effectively bypass intended access controls by leveraging their existing policy management privileges to modify policies for integrations they should not have access to, creating potential pathways for data exfiltration, system compromise, or further lateral movement within the environment. This flaw particularly affects organizations relying on Kibana Fleet for endpoint security management where proper segregation of duties is critical.
Security mitigations for this vulnerability require immediate implementation of proper authorization validation during policy update operations, ensuring that all integration type changes are validated against user permissions rather than stored policy data. Organizations should implement comprehensive access control reviews and privilege auditing to identify users who might be affected by this flaw. The fix involves modifying the authorization logic to validate integration types against user capabilities at the point of policy modification rather than relying on stored metadata, aligning with established security practices for preventing unauthorized privilege escalation as outlined in various cybersecurity frameworks including NIST SP 800-53 and ISO 27001 controls.