Vulnerability Details CVE-2026-56146
Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated user with read-only Security Solution access could perform write operations on watchlist data that should require elevated privileges. Under specific deployment conditions, this could also allow such a user to access data beyond their authorized scope.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 7.0%
CVSS Severity
CVSS v3 Score 5.4