Description

Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of case data by an authenticated user who has not been granted case editing privileges, via Manipulating User-Controlled Variables (CAPEC-77). Object attributes accepted by the case management API were not subject to the same authorization enforcement applied in the user interface, so a low-privileged user could alter case records they were only entitled to view.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-13T20:17:25.633Z",
  "pubdate": "2026-08-13T20:17:25.633Z",
  "executiveSummary": "An Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability, classified as CWE-915, exists within the case management functionality of Elastic Security in Kibana. This security flaw allows an authenticated low-privileged user, possessing only view-level entitlements, to execute unauthorized modifications of case data by manipulating user-controlled variables, aligning with CAPEC-77. The primary impact involves a violation of access control boundaries, enabling unauthorized data alteration within case management records without requiring explicit case editing privileges. The vulnerability presents significant risk regarding data integrity within enterprise monitoring and incident response workflows. Exploitation requires the attacker to be authenticated within the system and capable of interacting with the case management API endpoints. The root of the issue lies in the discrepancy between authorization enforcement applied in the graphical user interface versus the underlying API, where object attributes accepted by the API fail to enforce identical privilege checks.",
  "technicalDetails": "The vulnerability is rooted in the improper handling and sanitization of dynamically-determined object attributes within the case management API of Elastic Security in Kibana. Specifically, the API endpoints fail to subject incoming object attributes to the same rigorous authorization enforcement that is otherwise applied in the user interface. Consequently, when an authenticated user sends requests containing manipulated user-controlled variables via CAPEC-77, the backend application improperly processes and applies updates to case records despite the user lacking the requisite case editing privileges.\nThe attack flow proceeds as follows: First, an authenticated attacker with low privileges—specifically limited to view-only access on cases—identifies the target case management API endpoints utilized by Elastic Security. Second, the attacker crafts a malicious HTTP request targeting these API routes, injecting or modifying dynamically-determined object attributes within the payload that correspond to editable case fields. Third, because the API backend lacks proper authorization checks for these specific object attributes, the application processes the modification request. Finally, the server overwrites or updates the case records in the underlying data store, granting the low-privileged user unauthorized write access and compromising the integrity of the incident data.\nThe affected component is the case management API subsystem of Elastic Security in Kibana. The exploitation vector requires network access to the Kibana instance, a valid low-privileged user session, and the ability to issue API requests against the case management endpoints. Post-exploitation impact is characterized by unauthorized alteration, falsification, or corruption of case data, potentially disrupting incident response tracking, auditing capabilities, and forensic investigations managed within the Elastic Security platform."
}