CVE-2026-72661 Elastic CVE debrief

Who should care

Elastic Kibana administrators and users with low-privilege access should be aware of this vulnerability, as well as security teams monitoring for potential information disclosure. They should review and update Kibana user privileges to ensure least privilege access and implement additional monitoring and logging for endpoint response actions. Furthermore, verifying Kibana and Elastic Defend configurations for proper ACL enforcement is crucial to mitigate the risk of information disclosure via this vulnerability.

Technical summary

CVE-2026-72661 is a Missing Authorization issue in Kibana, allowing authenticated low-privileged users to read endpoint response action records with elevated internal permissions, potentially leading to information disclosure. This issue arises from an internal Kibana data retrieval capability used by Elastic Defend endpoint response actions that did not enforce the Security Solution and endpoint privileges required by its user-facing equivalents. As a result, an authenticated low-privileged Kibana user with no Security Solution privileges, endpoint privileges, and no Elasticsearch privileges on the underlying data could access these records.

Defensive priority

Authenticated low-privileged users may access elevated endpoint response action records.

Recommended defensive actions

• Review and update Kibana user privileges to ensure least privilege access.
• Implement additional monitoring and logging for endpoint response actions.
• Verify Kibana and Elastic Defend configurations for proper ACL enforcement.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE-2026-72661 record indicates a Missing Authorization issue in Kibana, allowing low-privileged users to read endpoint response action records with elevated internal permissions. Official CVE and NVD records provide details. To verify, defenders should review Kibana user privileges, endpoint response actions, and Elastic Defend configurations for proper ACL enforcement. Additionally, they should monitor for potential information disclosure and implement additional logging for endpoint response actions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.