CVE-2026-72655 in Kibana
Summary
by MITRE • 08/13/2026
Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of case data by an authenticated user who has not been granted case editing privileges, via Manipulating User-Controlled Variables (CAPEC-77). Object attributes accepted by the case management API were not subject to the same authorization enforcement applied in the user interface, so a low-privileged user could alter case records they were only entitled to view.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability described represents a critical authorization bypass flaw in Elastic Security's Kibana implementation that stems from improper control over dynamically determined object attributes. This weakness manifests as an insufficient access control mechanism where the case management API fails to enforce the same security restrictions that govern user interface interactions. The root cause lies in the inconsistent application of privilege checks between different system interfaces, creating a vector for unauthorized data manipulation.
This vulnerability falls under CWE-915, which specifically addresses issues where object attributes are modified through dynamically determined values without proper authorization validation. The flaw is particularly dangerous because it enables authenticated users to exploit manipulations of user-controlled variables as described in CAPEC-77, allowing them to alter case records they should not have editing privileges for. The security gap exists because the API layer processes attribute modifications without validating whether the requesting user possesses adequate permissions.
The operational impact of this vulnerability extends beyond simple data integrity concerns to encompass potential compromise of sensitive investigation data and operational security. Low-privileged users who can access the case management functionality but lack editing rights can manipulate case attributes, potentially altering evidence, changing case statuses, or modifying other critical metadata that affects forensic investigations. This unauthorized modification capability undermines the integrity of the entire case management system and could enable malicious actors to obscure or alter important investigative records.
The exploitation of this vulnerability requires an authenticated user with access to the case management functionality but without explicit editing privileges. Attackers can leverage this by crafting API requests that manipulate object attributes through user-controlled parameters, bypassing the authorization checks that normally prevent such modifications. The flaw demonstrates a classic lack of defense in depth where multiple layers of security controls fail to provide consistent protection across all system interfaces.
Mitigation strategies should focus on implementing consistent authorization enforcement across all access points including both UI and API interfaces. Security controls must validate user permissions for every attribute modification regardless of the interface used, ensuring that the same authorization rules apply universally. Organizations should also implement comprehensive input validation and parameter sanitization to prevent manipulation of dynamically determined object attributes, while establishing audit trails to detect unauthorized modifications to case data.
The vulnerability highlights the importance of maintaining consistent security controls across all system interfaces and demonstrates how differences in access control implementation between user-facing applications and backend APIs can create exploitable gaps. This type of flaw commonly appears in systems where security controls are implemented at the application layer but not consistently enforced across different communication protocols or interface types, making it essential to establish comprehensive authorization frameworks that protect data integrity regardless of access method used by authorized users.