THREATOPS
THREAT OPS › Threat News › [NVD] CVE-2026-72669 (HIGH 7.6) — The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover th

[NVD] CVE-2026-72669 (HIGH 7.6) — The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover th

mednvdPublished 2026-08-13

CVE-2026-72669 CVSS: 7.6 HIGH Published: 2026-08-13T20:17:27.403

The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flows of other users, read their onboardi

Indicators of compromise

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-72669