Description

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana data retrieval capability used by Elastic Defend endpoint response actions did not enforce the Security Solution and endpoint privileges that its user-facing equivalents require, and it retrieved data with elevated internal permissions rather than the permissions of the requesting user. As a result, an authenticated low-privileged Kibana user with no Security Solution privileges, endpoint privileges and no Elasticsearch privileges on the underlying data, could read endpoint response action records and the corresponding response content returned by managed hosts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T20:17:26.453Z",
  "pubdate": "2026-08-13T20:17:26.453Z",
  "executiveSummary": "A Missing Authorization vulnerability (CWE-862) has been identified in Kibana, leading to unauthorized information disclosure through Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1).\nThe vulnerability affects internal Kibana data retrieval capabilities utilized by Elastic Defend endpoint response actions.\nThe risk implication is severe as it allows unauthorized data access, bypassing intended role-based access controls and security privileges.\nAn authenticated low-privileged attacker with no prior Security Solution privileges, endpoint privileges, or underlying Elasticsearch data privileges can exploit this flaw.\nExploitation requires the attacker to have basic authentication to the Kibana instance to interact with the improperly constrained internal data retrieval capability.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate access control enforcement within an internal Kibana data retrieval capability associated with Elastic Defend endpoint response actions.\nInstead of validating the requesting user's permissions against the required Security Solution and endpoint privileges, the component executes queries using elevated internal permissions.\nThe vulnerable component fails to enforce access control lists (ACLs) and authorization checks that are natively enforced by its user-facing functional equivalents.\nAuthentication requirements dictate that the attacker must be an authenticated user within Kibana.\nHowever, privilege requirements are minimal, as an authenticated low-privileged user possessing zero Security Solution privileges, zero endpoint privileges, and zero Elasticsearch privileges on the underlying data can successfully execute the attack.\nThe attack flow proceeds as follows: First, the authenticated low-privileged user sends a request targeting the internal data retrieval capability used by Elastic Defend endpoint response actions. Second, the backend component processes the request utilizing elevated internal permissions rather than delegating or verifying the context of the requesting session. Third, the system retrieves and returns the sensitive records. Finally, the attacker receives unauthorized endpoint response action records and the corresponding response content generated by managed hosts, resulting in an information disclosure condition."
}