[CVE-2026-72658] Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Reque…

Descripción técnica

Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issued to Kibana in the context of the viewing user's session.

Puntuación CVSS

Score: 7.3/10 — Severidad: HIGH — Estado NIST: Received

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Debilidades (CWE)

CWE-352

Fuente oficial

Publicado en NIST NVD.