Description

Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). A user holding workflow edit permissions could cause scheduled workflow executions to run with the privileges of a different, higher-privileged user, allowing access to and modification of data beyond their own authorization scope.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-09-01T20:17:15.117Z",
  "pubdate": "2026-09-01T20:17:15.117Z",
  "executiveSummary": "A critical authorization flaw, categorized as CWE-863 (Incorrect Authorization), exists within Kibana, enabling a privilege escalation attack vector linked to CAPEC-180 (Exploiting Incorrectly Configured Access Control Security Levels).\nThe vulnerability manifests when a user assigned workflow edit permissions manipulates scheduled workflow executions to bypass authorization constraints.\nBy coercing the system to execute these workflows under the security context of a higher-privileged user, an attacker can achieve unauthorized data access and modification outside their established permissions scope.\nThis vulnerability poses a significant risk to data integrity and confidentiality within the Kibana environment.\nExploitation requires an attacker to already possess authenticated access with workflow modification capabilities, effectively leveraging legitimate configuration interfaces to perform unauthorized actions.\nThe impact is severe, as it permits unauthorized users to masquerade as privileged entities, potentially leading to full administrative compromise of the data accessed by the workflow service.",
  "technicalDetails": "The vulnerability originates from a failure in the authorization logic governing scheduled workflow execution in Kibana. Specifically, the system does not properly validate or encapsulate the security context associated with the user triggering the workflow against the service account or identity used to execute the task.\nUnder normal conditions, a scheduled workflow should operate within a confined security principal that adheres to the principle of least privilege. However, due to the identified CWE-863 flaw, the system permits a user with the ability to edit or configure these workflows to influence the execution identity.\nThe attack flow follows a structured path: First, the authenticated attacker, possessing workflow edit permissions, modifies the parameters of a pending or scheduled task. Second, during the execution phase, the Kibana workflow engine fails to re-verify the requesting user's authorization to initiate the action in the context of the workflow's primary owner.\nInstead, the engine executes the task using the security token or permissions level of a higher-privileged user, often a system administrator or an account with elevated privileges in the target indices. This allows the attacker to inject malicious operations, data retrieval requests, or modification scripts that the attacker would otherwise be blocked from performing.\nBecause the workflow engine treats the execution as legitimate and authorized, the underlying security controls—such as role-based access control (RBAC) and attribute-based access control (ABAC)—are bypassed for the duration of the task. The post-exploitation impact includes the ability to view, manipulate, or delete sensitive data within Kibana dashboards, indices, or underlying Elasticsearch data stores.\nFurthermore, because the operation is performed under the guise of a privileged user, audit logs may be misleading or ambiguous, complicating the detection of the malicious activity. This vulnerability effectively turns the scheduled workflow mechanism into a privilege escalation primitive that violates the trust boundary between users and the execution environment."
}