{"apiVersion":"1.0","identifier":"CVE-2026-72658","description":"Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issued to Kibana in the context of the viewing user-s session.","publishedAt":"2026-08-13T20:17:26","lastModifiedAt":"2026-08-28T15:32:26","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72658","cvssScore":7.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","epssProbability":0.00133,"riskScore":0.74,"affectedProduct":"Kibana","affectedVersions":"unknown","vulnerabilityType":"Web app","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72658","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72658","en":"https://www.redsauce.net/en/cves/CVE-2026-72658","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72658","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72658","de":"https://www.redsauce.net/de/cves/CVE-2026-72658","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72658","el":"https://www.redsauce.net/el/cves/CVE-2026-72658"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72658"}}