CVE-2026-72662

Executive Summary

CVE-2026-72662 is an authorization bypass vulnerability (CWE-639, "Authorization Bypass Through User-Controlled Key") in Kibana. An authenticated user who holds the Timeline feature privilege within a Kibana space can enumerate, read, modify, and delete draft Timeline objects belonging to other users in that same space by manipulating a user-controlled object key, because the affected functionality is not properly constrained by access control lists. The impact is unauthorized disclosure, modification, and deletion of draft Timeline data, rated CVSS 6.3 (Medium) with Low confidentiality, integrity, and availability impact.

Technical Analysis

The root cause is CWE-639, Authorization Bypass Through User-Controlled Key. In this class of flaw, an application uses an identifier or key supplied by the requester (for example, an object ID) to look up or act upon a resource, but fails to verify that the requesting principal is authorized to access that specific resource. Access control is instead applied only at a coarse level — in this case, a feature-level privilege check — rather than enforced per-object against the owner or the object's ACL.

The NVD description maps this directly to CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs). The relevant attack surface is the Kibana Timeline feature inside a Kibana space. A user who has been granted the Timeline feature privilege in a space can interact with Timeline objects. The vulnerability is that this feature privilege is not sufficiently scoped to the requesting user's own objects: draft Timeline objects belonging to other users in the same space are not protected by per-object authorization when accessed via a user-controlled key.

Two distinct privilege levels govern the impact severity. Read access alone is sufficient to enumerate and disclose other users' draft Timelines — an attacker does not need write permissions to harvest this data. The Timeline write privilege is additionally required to modify or delete draft Timeline objects belonging to other users. This means that within a space, a low-privileged but legitimately authenticated user with only read-level Timeline access already constitutes a disclosure risk, while a user with write-level Timeline access can perform destructive operations against other users' drafts.

Because the flaw resides in how object ownership is validated rather than in cryptographic or input-parsing logic, standard perimeter controls are ineffective. The attacker is a valid, authenticated user; no authentication bypass is needed, and there is no reliance on malformed input. The attack is a straightforward case of an authenticated user requesting resources they should not be permitted to touch.

No public proof-of-concept, exploit code, or Nuclei template was identified for CVE-2026-72662 at the time of writing. No affected-version identifiers were supplied by the CNA, and no patch evidence exists from any tracked source. No further code-level detail — such as specific endpoint paths, request parameters, or internal object identifiers — is available in the provided intelligence, and none should be assumed.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-639) and the behavior described in the NVD entry. No specific endpoints, parameters, or identifiers are invented here.

1. Reconnaissance / target identification. The attacker identifies a Kibana deployment and confirms they hold a valid, authenticated account. Critically, the attacker needs to have been granted the Timeline feature privilege within a target Kibana space — either as part of their legitimate role or through any means that grants that feature privilege. The attacker enumerates the spaces they can access and confirms Timeline functionality is reachable.

2. Triggering the flawed authorization path. Within the accessible space, the attacker interacts with Timeline objects. Because authorization over draft Timelines is enforced at the feature/ACL level rather than per-object ownership, the attacker manipulates the user-controlled key that identifies a Timeline object in order to reference draft Timelines belonging to other users in the same space. The application resolves and returns objects that the attacker does not own.

3. Payload / execution at the vulnerability-class level. There is no injected payload in the classic sense. The "payload" is the manipulated user-controlled object key supplied in a request to Timeline functionality. By iterating or substituting keys, the attacker enumerates objects. Where the attacker additionally holds the Timeline write privilege, the same weak per-object authorization permits requests that modify or delete other users' draft Timelines.

4. Post-exploitation impact. Disclosure: the attacker harvests the contents of other users' draft Timelines, which may contain sensitive investigative notes, queries, or event references. Integrity: with write privilege, the attacker alters other users' drafts, potentially poisoning investigations or embedding misleading content. Availability: with write privilege, the attacker deletes drafts outright, destroying work product. Because the actions occur under the attacker's own authenticated identity, they may blend into normal Timeline usage.

Impact Assessment

The CVSS 3.1 base score is 6.3 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The network attack vector (AV:N) and low attack complexity (AC:L) mean the flaw is remotely reachable and requires no special conditions to trigger. The low privileges required (PR:L) reflect that the attacker must be an authenticated user holding the Timeline feature privilege in the space — this is the primary limiting factor that keeps the score in the Medium range rather than High. No user interaction (UI:N) is needed; the attacker acts directly. Scope is unchanged (S:U), meaning the impact is contained within the vulnerable Kibana authorization context.

Confidentiality, integrity, and availability are each rated Low (C:L/I:L/A:L). This reflects that the exposure is bounded to draft Timeline objects within a single space rather than the entire Kibana data estate. However, "Low" should not be misread as negligible: draft Timelines in a security-operations context can contain sensitive investigative scoping, raw event references, and analyst reasoning. The integrity and availability impacts correspond directly to the two-tier privilege requirement — read access enables enumeration and disclosure, while write access additionally enables modification and deletion.

Blast radius is confined to a single Kibana space and to draft Timeline objects within it. Users in other spaces are unaffected by this specific access path. Enterprises with many analysts sharing spaces, where draft Timelines are used as working documents, face the greatest exposure. There is no evidence of CISA KEV listing, no known threat-actor campaign, and no observed exploitation in the wild in the provided intelligence.

Detection Guidance

Detection for this vulnerability is challenging because exploitation uses legitimate, authenticated API calls to Timeline functionality. Detection should focus on anomalous access patterns to Timeline objects — enumeration behavior, access to object identifiers not associated with the requesting user, and abnormal read/modify/delete volumes — correlated against the authenticated principal.

Sigma Rule

title: Potential Kibana Timeline Object Authorization Bypass (CVE-2026-72662)
id: 8f3c1a72-6d4e-4b91-9c2a-7e5b1d0f3a44
status: experimental
description: Detects anomalous access or enumeration of Kibana Timeline objects that may indicate exploitation of CVE-2026-72662, an authorization bypass through user-controlled key (CWE-639) affecting draft Timeline objects.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-72662
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1213
  - cve.2026-72662
logsource:
  product: kibana
  service: audit
detection:
  selection_method:
    event.action:
      - 'timeline_read'
      - 'timeline_update'
      - 'timeline_delete'
      - 'timeline_get'
  selection_anomaly:
    kibana.space.id|exists: true
    user.name|exists: true
  timeframe: 5m
  condition: selection_method and selection_anomaly | count() by user.name, kibana.space.id > 50
falsepositives:
  - Bulk timeline management by power users or automation
  - Legitimate administrative cleanup of stale drafts
level: medium

YARA Rule

rule CVE_2026_72662_Kibana_Timeline_AuthzBypass
{
    meta:
        description = "Detects Kibana Timeline authorization bypass indicators (CVE-2026-72662) in captured HTTP request/response or audit logs"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-72662"
        date = "2026-01-01"
        cve = "CVE-2026-72662"

    strings:
        $timeline = "timeline" ascii nocase
        $draft = "draft" ascii nocase
        $space = "/s/" ascii
        $api = "/api/" ascii
        $kibana = "kbn-xsrf" ascii nocase
        $save = "savedObject" ascii nocase

    condition:
        uint16(0) != 0x0000 and
        $timeline and $api and
        2 of ($draft, $space, $kibana, $save)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-72662 Kibana Timeline Authorization Bypass Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/"; content:"timeline"; nocase; http.header; content:"kbn-xsrf"; nocase; threshold: type both, track by_src, count 50, seconds 60; classtype:attempted-user; reference:cve,2026-72662; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-72662; sid:2026726; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ any where event.category == "web" and event.action in ("timeline_read", "timeline_get") and url.path : "*/timeline*" ]
  [ any where event.category == "web" and event.action in ("timeline_update", "timeline_delete") and url.path : "*/timeline*" ]
  [ count by user.name ] > 20

Splunk SPL Query

index=kibana sourcetype=kibana:audit
  (event.action="timeline_read" OR event.action="timeline_get" OR event.action="timeline_update" OR event.action="timeline_delete" OR uri="*/api/*timeline*")
| stats count, dc(timeline.id) as distinct_timelines, values(event.action) as actions by user.name, kibana.space.id, src_ip
| where count > 50 OR distinct_timelines > 25
| eval risk="CVE-2026-72662 potential Timeline authorization bypass / enumeration"
| sort - count

Wazuh OSSEC Rule

<group name="kibana,cve-2026-72662,">
  <rule id="2026726" level="10">
    <decoded_as>json</decoded_as>
    <field name="event.action">timeline_(read|get|update|delete)</field>
    <field name="kibana.space.id">\.+</field>
    <description>CVE-2026-72662: Potential Kibana Timeline object authorization bypass or enumeration attempt</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <group>cve_2026_72662,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The CNA and NVD entries provide no vendor fix reference and no affected-version identifiers, so no upgrade target can be named from the available data. The following measures are general hardening steps for an unpatched authorization-bypass flaw.

1. Immediate mitigations.

   • Audit which users and roles hold the Timeline feature privilege across all Kibana spaces. In CWE-639 flaws, reduced privilege scope directly reduces exposure — revoke the Timeline privilege from any principal that does not require it. Note that read access alone enables disclosure, so read-level Timeline grants are still risky.
   • Where the Timeline feature is not business-critical, disable or restrict access to it for non-essential users until a fix is available.
   • Restrict the number of users sharing a space and limit write-level Timeline grants to the smallest possible set, since write privilege is the gate for modification and deletion of others' drafts.
   • Monitor for anomalous Timeline access patterns (see Detection Guidance) and treat cross-user access to draft objects as a security event.
   • Isolate Kibana spaces by sensitivity so that low-trust users do not share spaces with users whose draft Timelines contain sensitive content.

2. Patch / upgrade steps.

   • No patch or fixed version is currently identified. Monitor the Elastic Kibana security advisories and the NVD entry for CVE-2026-72662 for an official fix. When a patch is released, upgrade all Kibana nodes in the cluster to the fixed version and verify per-object authorization behavior after upgrade using test accounts with differing privileges.
   • Because patch confidence is 0/4, do not assume any current Kibana release resolves this issue unless confirmed by an official advisory.

3. Long-term hardening.

   • Enforce least privilege on Kibana feature privileges and space assignments; adopt role designs that avoid granting write-level Timeline access broadly.
   • Prefer fine-grained, per-object authorization models in custom integrations and workflows, and validate object ownership server-side on every access.
   • Maintain audit logging of Timeline read/update/delete operations with the authenticated principal captured, and alert on enumeration patterns.
   • Include authorization-bypass (CWE-639) test cases in periodic penetration testing of Kibana deployments, focusing on cross-user object access within shared spaces.

References

• NVD — CVE-2026-72662: https://nvd.nist.gov/vuln/detail/CVE-2026-72662
• MITRE CWE-639 (Authorization Bypass Through User-Controlled Key): https://cwe.mitre.org/data/definitions/639.html
• MITRE CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs): https://capec.mitre.org/data/definitions/1.html
• Elastic Security Advisories (monitor for a Kibana advisory covering CVE-2026-72662; none identified in available data): https://discuss.elastic.co/c/announcements/security-announcements
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-72662 is NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns, exploit-in-the-wild evidence, public proof-of-concept, exploit code, or Nuclei template were identified for CVE-2026-72662 in the provided intelligence. EPSS has not yet scored this CVE.