Description

Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only Security Solution read access in a Kibana space could enumerate and change the state of Entity Store maintainer tasks, silently disabling Entity Analytics maintenance for that space.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-01T20:17:16.613Z",
  "pubdate": "2026-09-01T20:17:16.613Z",
  "executiveSummary": "This vulnerability is classified as Incorrect Authorization (CWE-863), facilitating unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1).\nThe issue resides within Kibana, specifically impacting the Entity Store maintenance functionality.\nThe vulnerability allows an authenticated user, assigned with restricted 'Security Solution' read-only privileges, to bypass intended access control lists (ACLs) to perform unauthorized write operations.\nThe primary impact involves the ability of a low-privileged user to enumerate and manipulate the state of Entity Store maintainer tasks.\nBy modifying these tasks, an attacker can silently disable Entity Analytics maintenance for a specific Kibana space, leading to a disruption of service for security analytics operations.\nThe risk implication is significant as it permits integrity compromise of security configurations by users who should strictly be limited to read-only capabilities.\nExploitation requires the attacker to possess a valid authentication session within the Kibana environment and minimal read-access privileges, posing a risk of internal privilege escalation and configuration tampering.",
  "technicalDetails": "The root cause of this vulnerability is an improper implementation of authorization checks within the Kibana Entity Store management module. While the system correctly restricts certain administrative actions, it fails to enforce comprehensive access control policies on the internal API endpoints responsible for managing background maintainer tasks.\nThe vulnerable component involves the task management subsystem responsible for Entity Analytics maintenance. Although these tasks are intended to be managed by users with administrative or write-level privileges, the application logic incorrectly validates permissions for these specific API calls when invoked by users with 'Security Solution' read-only roles.\nThe attack flow begins when an authenticated user with restricted read access identifies the API endpoints associated with Entity Store maintenance, typically through observing internal network requests within the Kibana dashboard. Upon discovery, the user can craft malicious HTTP requests directed at these endpoints.\nBecause the backend fails to perform a granular check to verify if the requesting user possesses the required authorization level to modify task states, the system honors the request. The attacker can enumerate existing tasks to retrieve internal identifiers and then issue state-change commands—such as disabling or pausing maintenance threads—without triggering an unauthorized access alert.\nPayload behavior involves submitting state-change commands to the internal Task Manager via the Kibana API. By successfully altering these task statuses, the attacker effectively disables the maintenance cycle for the Entity Analytics component. This is a 'silent' failure, as the interface may not immediately reflect the background disruption to the analytics engine, leading to data staleness or failure of underlying security detections that rely on these maintenance tasks.\nPost-exploitation impact is defined by the loss of system integrity. By disabling maintenance tasks, an attacker can prevent the cleanup or optimization of entity data, potentially causing a performance degradation of the Security Solution or leading to an inconsistent state that inhibits the efficacy of security monitoring. This vulnerability demonstrates a failure in the principle of least privilege, where functional separation between read-only visibility and configuration modification is absent for sensitive background processes."
}