Description

Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only read-level Security feature access, and no Elasticsearch privileges, could stop the recurring Privilege Monitoring engine task for a Kibana space. Privileged user monitoring then stops producing data for that space while the engine continues to report a healthy state to operators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-01T20:17:16.497Z",
  "pubdate": "2026-09-01T20:17:16.497Z",
  "executiveSummary": "This vulnerability involves an Incorrect Authorization flaw (CWE-863) within the Kibana Entity Analytics component, specifically impacting the Privilege Monitoring engine.\nThe issue allows an authenticated user with restricted read-only security permissions, and notably lacking Elasticsearch administrative privileges, to perform unauthorized actions on background task management.\nThe primary impact is a Denial of Service (DoS) regarding security monitoring capabilities. By terminating the recurring task responsible for monitoring privileged user activity, an attacker can effectively blind security operations for a specific Kibana space.\nThe risk is exacerbated because the monitoring engine continues to report a 'healthy' state to system administrators, masking the disruption. Exploitation requires authenticated access to the Kibana environment but does not necessitate high-level administrative credentials.\nThis vulnerability highlights a critical failure in enforcing Access Control Lists (ACLs) within the Kibana task orchestration layer, categorized under CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs).",
  "technicalDetails": "The root cause of this vulnerability lies in an improper authorization check within the Kibana Entity Analytics framework. The application fails to strictly validate whether a user session possesses sufficient privileges before allowing interaction with the task management API endpoints that govern the Privilege Monitoring engine.\nIn a standard deployment, the Privilege Monitoring engine operates as a recurring background task. Kibana utilizes an internal task manager to track and execute these processes. The vulnerability resides in the interface that allows users to manage or stop these tasks, which fails to verify if the user's role grants permission to modify system-level tasks.\nThe attack flow begins when an authenticated user, assigned a read-only role for the Kibana security feature, targets the API endpoint responsible for task lifecycle management. Despite having no Elasticsearch-level privileges, the user sends a request to stop the specific task identifier associated with the Privilege Monitoring engine for a target Kibana space.\nBecause the authorization logic is insufficient, the Kibana backend honors this request, terminating the monitoring task immediately. The attack is highly impactful because the Privilege Monitoring engine's reporting mechanism is decoupled from the task executor's health state. Consequently, the telemetry or dashboard displays within Kibana continue to indicate that monitoring is active and healthy, effectively concealing the cessation of data collection from security operations centers (SOC) and administrators.\nThis behavior represents a classic case of CAPEC-1, where functionality that should be restricted to administrators or service accounts is accessible to low-privilege users. Post-exploitation, the attacker achieves a persistent monitoring blackout for the affected space. The lack of an 'unhealthy' status alert ensures that the security degradation remains undetected, allowing for potential malicious activity within the monitored environment to proceed without the oversight of the Privilege Monitoring engine."
}