CVE-2026-72654: Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosur

A vulnerability in Kibana's machine learning feature allows users with only read access to view data they shouldn't have permission to see. The problem occurs because an operation runs with elevated internal service permissions instead of the user's actual permissions, letting attackers access unauthorized information from Elasticsearch (a data storage system) without needing special cluster or index privileges.