Missing Authorization in Kibana Leading to Cross-User Information Disclosure and Data Tampering (Elastic Kibana)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.33 % · percentile 26 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- elastic
- NVD status
- Analyzed
Description
The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flows of other users, read their onboarding state, and write arbitrary progress data into them. A tampered flow can also cause the owner's onboarding view to fail with a server error.
Weaknesses (CWE)
- CWE-862 — Missing Authorization
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L | elastic |
| CVSS 3.1 | HIGH 7.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L | NVD · security@elastic.co (Secondary) |
European references
- ENISA EUVD · EUVD-2026-58256
- GCVE · GCVE-0-2026-72669
CERT-FR advisories
- CERTFR-2026-AVI-1020 — Multiples vulnérabilités dans Elastic Kibana · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*≥ 8.9.0 < 8.19.19cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*≥ 9.0.0 < 9.4.5
Affected products
| Product | Versions |
|---|---|
| Elastic · Kibana | affected 8.9.0 ≤ 8.19.18 ; affected 9.0.0 ≤ 9.4.4 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |