PULSEUnderground Intel

EN VIVO21señales / 24h

FEED

ransompanzer reclama a Yodingenierie · BJ · Professional Servicesransomqilin reclama a White & Case · US · Professional Servicesransomqilin reclama a Hossner-Textil GmbH · DE · Manufacturingransomwhitearmor reclama a Partido Liberal · AR · Government & Defenseransomqilin reclama a Ooredoo Myanmar · MM · Technologyransomfalcon reclama a Weitz & Luxenberg · US · Professional Servicesransomfalcon reclama a Astrana Health · US · Healthcareransomemperador reclama a A-RMS · Government & Defenseransomhyflock reclama a Aesthetic Dental Designs, P.A · US · Healthcareransomqilin reclama a ECOM · CH · Retail & E-Commerceransomemperador reclama a AyT COMPUTERS SRL · Technologyransomqilin reclama a ETO · DE · Not Foundransomn0n reclama a TOPLIVO AD · BG · Energy & Utilitiesransomn0n reclama a Technoleads Services Inc. · Technologyransompanzer reclama a Yodingenierie · BJ · Professional Servicesransomqilin reclama a White & Case · US · Professional Servicesransomqilin reclama a Hossner-Textil GmbH · DE · Manufacturingransomwhitearmor reclama a Partido Liberal · AR · Government & Defenseransomqilin reclama a Ooredoo Myanmar · MM · Technologyransomfalcon reclama a Weitz & Luxenberg · US · Professional Servicesransomfalcon reclama a Astrana Health · US · Healthcareransomemperador reclama a A-RMS · Government & Defenseransomhyflock reclama a Aesthetic Dental Designs, P.A · US · Healthcareransomqilin reclama a ECOM · CH · Retail & E-Commerceransomemperador reclama a AyT COMPUTERS SRL · Technologyransomqilin reclama a ETO · DE · Not Foundransomn0n reclama a TOPLIVO AD · BG · Energy & Utilitiesransomn0n reclama a Technoleads Services Inc. · Technology

← Todos los CVEs

CVE Watch28 sept 2026

CVE-2026-72662

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data

CVSS

6.3

Medio

EPSS

0.2%

p7

KEV

—

Exploit Today

2

0-100

Publicado: 26 sept 2026 · Última mod.: 28 sept 2026 · CWE-639

EPSS · 30d

0.2%EPSS · 30 días0.2%

2026-09-272026-10-25

Descripción técnica

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user granted the Timeline feature privilege in a Kibana space could enumerate, read, modify, and delete draft Timeline objects belonging to other users in the same space. Read access is sufficient for enumeration and disclosure; the Timeline write privilege is required for modification and deletion.

Referencias oficiales

discuss.elastic.cohttps://discuss.elastic.co/t/kibana-8-19-22-9-4-6-security-update-esa-2026-103/390679

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1160688.8 ALT

——0Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnvironment, updateTraefikConfig, deploy, or stop to overwrite environment variables and build secrets, repoint sources, and disrupt other tenants' applications.12h CVE-2026-1160184.3 MED

——3ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read via POST /api/notifications/:id/read. Attackers can iterate sequential notification IDs to suppress unread indicators of users in the same tenant, causing them to miss replies, comments and new-content notices.1d CVE-2026-1160174.3 MED

——4Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request /device/address-book/{macAddress} with another user's device MAC to obtain contact MACs, aliases, call permissions, and owner user IDs.1d CVE-2026-1160154.3 MED

——4yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other members' after-sale operation logs by supplying arbitrary afterSaleId values. Attackers can enumerate sequential after-sale IDs against GET /app-api/trade/after-sale-log/list to expose refund amounts, status transitions and timestamps belonging to other members.1d CVE-2026-1160104.3 MED

——3RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the st_arr, values, or attendance POST arrays in MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php to create referrals, eligibility codes, attendance and final grades for any student in the school.1d CVE-2026-1159984.3 MED

——3IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity.2d