Description

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user who is authorized to read alerting rules in a single Kibana space could retrieve alerting rule execution telemetry that belongs to spaces the user is not authorized to access. The disclosed telemetry includes rule identifiers, rule names, space identifiers, execution outcomes, timestamps, and execution counters.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-13T20:17:25.280Z",
  "pubdate": "2026-08-13T20:17:25.280Z",
  "executiveSummary": "An authorization bypass vulnerability classified as CWE-639 (Authorization Bypass Through User-Controlled Key) exists in Kibana, leading to information disclosure via CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs). The flaw enables an authenticated user who is legitimately authorized to read alerting rules within a single Kibana space to illicitly retrieve sensitive alerting rule execution telemetry belonging to other spaces they lack explicit authorization to access. The compromised data encompasses critical operational metrics including rule identifiers, rule names, space identifiers, execution outcomes, timestamps, and execution counters. This security defect undermines spatial isolation boundaries within multi-tenant or segmented Kibana deployments, allowing unauthorized internal reconnaissance of background automation and alerting states across restricted operational contexts. Exploitation requires prior authentication to the application and assumes the adversary possesses low-level privileges restricted to at least one valid Kibana space, shifting the security risk landscape toward lateral information harvesting and potential leakage of sensitive workflow configurations.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient access control enforcement and improper validation of user-supplied identifiers (CWE-639) when processing requests for alerting rule execution telemetry. In multi-space Kibana environments, access control lists (ACLs) are expected to strictly partition resources and telemetry based on the active space context. However, the affected component fails to adequately verify whether the authenticated principal possesses the requisite administrative or read privileges for targeted external spaces when query parameters or keys referencing specific space identifiers are supplied by the user.\nThe attack flow proceeds as follows: First, an authenticated attacker with valid credentials provisions or leverages existing access to a single authorized Kibana space where they possess permissions to read local alerting rules. Second, the attacker crafts or intercepts requests directed at the alerting rule execution telemetry endpoints. By manipulating user-controlled keys or parameters—such as space identifiers—within the request context, the attacker bypasses the logical boundaries enforced by the application's ACL mechanism (CAPEC-1). Third, the vulnerable backend component processes the request without correctly enforcing tenant or space separation constraints, thereby returning telemetry payloads originating from unauthorized spaces.\nThe post-exploitation impact includes unauthorized information disclosure of internal automation structures. Specifically, the retrieved payload exposes rule identifiers, rule names, cross-space identifiers, execution outcomes, precise timestamps, and execution counters. This intelligence can assist an adversary in mapping organizational workflows, identifying active security monitoring thresholds, and discovering operational dependencies across isolated tenants. Prerequisites for exploitation include valid user authentication to Kibana and low-privileged access restricted to at least one legitimate space. The vulnerability involves server-side processing of telemetry data and operates within the established network protocols utilized by the Kibana web interface."
}