CVE-2026-72669

CVE-2026-72669 is an IDOR in Kibana's onboarding state management that allows an authenticated attacker to read and write another user's onboarding progress, inducing server errors in the victim's view. The critical insight here is not the CVSS 7.6 score — it's the vulnerability's location in a feature that serves as the approved bootstrap path into privileged integrations, credential configuration, and scoped permissions. Treating onboarding as non-critical because it's 'just setup' is the same reasoning error that has produced this flaw class repeatedly since at least 2016. The damage model extends beyond denial-of-service. Corrupted onboarding state can trigger downstream failures that expose internal URLs, leak credential-adjacent error messages through retry logic, or leave accounts in half-initialized states with partial permissions. The state store likely accumulated connections to other features over time, each added under the assumption that 'internal user-scoped data' was trustworthy — but that assumption depended on an access model that has since widened. The fix is three lines of code: bind onboarding state to user ID and verify ownership before any read or write. The systemic failure is why those three lines didn't exist. This wasn't entropy — a gradual invisible degradation. It's a documented failure mode with a known signature, sitting in CVE metadata that no one queried. Your onboarding flows, setup wizards, and configuration assistants are not peripheral — they're the front door. Audit them for explicit ownership binding in their schema, enforced at the infrastructure layer, not left to individual engineers to remember.

Reviewed through automated stages and approved by a human before publication.