https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 23:51:20 +0000 https://cve.radiocsirt.org/vuln/cve-2026-78597 <p><strong>Affected:</strong> Elastic Kibana</p> <p>Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only low-privilege Security feature access could invoke an administrative operation that creates and persists Elasticsearch API keys under the caller&#39;s identity, bypassing the elevated cluster and Kibana privileges that the documented Entity Store setup flow requires.</p> <p><strong>Affected:</strong> Elastic Kibana</p> <p>Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only low-privilege Security feature access could invoke an administrative operation that creates and persists Elasticsearch API keys under the caller&#39;s identity, bypassing the elevated cluster and Kibana privileges that the documented Entity Store setup flow requires.</p> https://cve.radiocsirt.org/vuln/cve-2026-78597