Description

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user granted the Timeline feature privilege in a Kibana space could enumerate, read, modify, and delete draft Timeline objects belonging to other users in the same space. Read access is sufficient for enumeration and disclosure; the Timeline write privilege is required for modification and deletion.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-26T21:16:55.410Z",
  "pubdate": "2026-09-26T21:16:55.410Z",
  "executiveSummary": "This vulnerability is classified as an Authorization Bypass Through User-Controlled Key (CWE-639) within Kibana, specifically targeting the Timeline feature. The flaw permits authenticated users, who possess valid access to the Timeline feature within a Kibana space, to bypass existing Access Control Lists (ACLs) to perform unauthorized operations on objects created by other users.\nThe scope of this vulnerability encompasses the unauthorized disclosure, modification, and deletion of draft Timeline objects residing within the same Kibana space. An attacker requires a valid, authenticated session and the Timeline feature privilege to exploit this flaw. By manipulating user-controlled identifiers, an attacker can access objects for which they lack appropriate authorization, leading to a significant breakdown in data confidentiality and integrity. The risk is elevated as the attack does not require administrative privileges, merely standard user access within the affected space, effectively granting unauthorized horizontal privilege escalation across user-owned resources.",
  "technicalDetails": "The root cause of the vulnerability lies in improper validation of object identifiers during API requests associated with the Timeline feature in Kibana. The system fails to strictly enforce ownership-based constraints or validate that the requesting user's identity has explicit access to the specific Timeline object referenced in the request parameters (CAPEC-1). Instead of verifying the requestor's authorization for the specific object key, the application logic assumes that the presence of the Timeline feature privilege implicitly grants permission to interact with all objects within the space, regardless of the object's creator or ownership status.\nThe exploitation flow begins with an authenticated user identifying the API endpoint responsible for interacting with Timeline objects. Because the underlying access control check is insufficient, the user can supply different object identifiers (keys) in the API request. For enumeration and disclosure, a user can iterate through potential identifiers or inspect requests to view data associated with other users' drafts. If the attacker possesses the standard Timeline write privilege, the lack of server-side object ownership verification allows the attacker to issue 'PUT' or 'DELETE' requests targeting identifiers that belong to other users within the same space.\nStep-by-step, the attack proceeds as follows: 1) The attacker authenticates to a Kibana space. 2) The attacker initiates a request to the Timeline API, identifying the object key associated with a target draft Timeline belonging to another user. 3) The application processes the request, verifying that the attacker has the base Timeline feature privilege but neglecting to verify if the attacker owns or is explicitly authorized to modify the target object key. 4) The application executes the operation (Read, Update, or Delete) on the target object. 5) The sensitive data is disclosed or the object is modified/deleted based on the attacker's intent.\nThe vulnerable component is the Timeline feature's object management logic, specifically the handler responsible for processing user requests and enforcing access controls on individual drafts. This vulnerability facilitates horizontal privilege escalation, enabling an authenticated actor to bypass security boundaries intended to isolate user data. The impact is significant, as it violates the principle of least privilege and allows for the silent destruction or theft of intellectual property and security-related telemetry contained within Timeline objects."
}