Description

Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing integration policies for one specific integration. When an existing integration policy was updated, that restriction was evaluated against the integration recorded on the stored policy rather than against the replacement integration supplied with the update. An authenticated user holding only the Elastic Defend endpoint policy management privilege was therefore able to convert an endpoint policy they administer into a policy for a different integration, and to supply that integration's configuration at the same time.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-13T20:17:23.813Z",
  "pubdate": "2026-08-13T20:17:23.813Z",
  "executiveSummary": "An Incorrect Authorization vulnerability identified as CWE-863 exists within Kibana Fleet, potentially leading to privilege escalation through Privilege Abuse (CAPEC-122).\nThe vulnerability allows an authenticated user with limited privileges to bypass intended access control restrictions when updating integration policies.\nSpecifically, users holding only the Elastic Defend endpoint policy management privilege can convert an endpoint policy they administer into a policy for a different integration and supply arbitrary configurations for that integration.\nThe risk implication involves unauthorized modification of integration policies, enabling lower-privileged users to gain administrative control or operational capabilities over unauthorized integrations within the Fleet management interface.\nExploitation requires authenticated access to Kibana Fleet and possession of the specific Elastic Defend endpoint policy management privilege.\nNo additional external exploitation vectors or complex preconditions are mandated beyond the ability to update existing integration policies within the affected system.",
  "technicalDetails": "The root cause of the vulnerability resides in flawed authorization logic within Kibana Fleet during the processing of integration policy updates.\nFleet is designed to restrict specific callers to managing integration policies tied exclusively to one designated integration.\nDuring the execution of an existing integration policy update operation, the authorization restriction check was evaluated against the integration recorded on the previously stored policy rather than against the replacement integration supplied within the incoming update payload.\nThis validation flaw enables an authenticated user possessing only the Elastic Defend endpoint policy management privilege to successfully submit a policy update request that modifies the underlying integration type.\nThe attack flow proceeds as follows: First, the authenticated attacker targets an existing integration policy that they are authorized to manage under the Elastic Defend endpoint policy management role.\nSecond, the attacker crafts an update request that supplies a replacement integration identifier and an associated configuration for that different integration.\nThird, the vulnerable Fleet backend evaluates the authorization constraint against the original stored policy's integration type instead of validating against the newly requested replacement integration.\nFourth, the authorization check improperly succeeds, permitting the policy type conversion.\nFinally, the system stores and applies the unauthorized integration policy and its corresponding configuration payload.\nThe vulnerable component is the Fleet policy management and authorization validation module within Kibana.\nThe authentication requirement is an authenticated user session, and the prerequisite privilege requirement is holding the Elastic Defend endpoint policy management privilege.\nThe post-exploitation impact allows the attacker to administer and deploy configurations for integrations outside their assigned authorization scope, thereby achieving privilege escalation via CAPEC-122."
}