Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure (Elastic Kibana)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.34 % · percentile 28 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- elastic
- NVD status
- Analyzed
Description
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user who is authorized to read alerting rules in a single Kibana space could retrieve alerting rule execution telemetry that belongs to spaces the user is not authorized to access. The disclosed telemetry includes rule identifiers, rule names, space identifiers, execution outcomes, timestamps, and execution counters.
Weaknesses (CWE)
- CWE-639 — Authorization Bypass Through User-Controlled Key
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | elastic |
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | NVD · security@elastic.co (Secondary) |
European references
- ENISA EUVD · EUVD-2026-58275
- GCVE · GCVE-0-2026-72650
CERT-FR advisories
- CERTFR-2026-AVI-1020 — Multiples vulnérabilités dans Elastic Kibana · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*≥ 8.0.0 < 8.19.20cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*≥ 9.0.0 < 9.4.5
Affected products
| Product | Versions |
|---|---|
| Elastic · Kibana | affected 8.0.0 ≤ 8.19.19 ; affected 9.0.0 ≤ 9.4.4 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |