Description

Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A Kibana user who holds only detection rule authoring privileges for the Elastic Security solution can associate automated endpoint response actions with a detection rule, even though the dedicated Endpoint response action privileges that govern those capabilities (host isolation, process operations, and execute operations) have not been granted to that user. When such a rule generates alerts, the associated response actions are carried out against the matching hosts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T20:17:26.910Z",
  "pubdate": "2026-08-13T20:17:26.910Z",
  "executiveSummary": "A Missing Authorization vulnerability (CWE-862) exists in Kibana, specifically affecting the Elastic Security solution and its integration with Elastic Defend response actions on managed hosts via CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs). The vulnerability allows a low-privileged Kibana user, who possesses only detection rule authoring privileges, to associate automated endpoint response actions—such as host isolation, process operations, and execute operations—with detection rules despite lacking the dedicated Endpoint response action privileges required to govern those sensitive capabilities. When the affected detection rule triggers and generates alerts, the system executes the associated automated response actions against matching managed hosts without proper authorization checks. The risk implications include unauthorized execution of high-privilege host response capabilities, potentially leading to operational disruption, unauthorized host isolation, or unauthorized command execution across managed endpoints. Exploitation requires the attacker to possess authenticated access to Kibana with at least detection rule authoring capabilities, allowing them to leverage the permission discrepancy to execute privileged actions indirectly through automated rule triggers.",
  "technicalDetails": "The vulnerability stems from improper access control enforcement within the Kibana authorization framework when linking automated endpoint response actions to detection rules within the Elastic Security solution. Specifically, the vulnerable component fails to validate whether the authenticated user modifying or creating a detection rule holds the dedicated Endpoint response action privileges required to authorize sensitive operations on managed hosts. While these sensitive operations—including host isolation, process operations, and execute operations—are intended to be strictly governed by specialized access control lists (ACLs), the system improperly permits users holding solely detection rule authoring privileges to attach these actions to detection rules. The attack flow begins with an authenticated user who possesses low-level detection rule authoring permissions navigating the Elastic Security application in Kibana. The user creates or modifies a detection rule and appends unauthorized automated endpoint response actions to the rule configuration. Because the backend authorization check is missing or insufficiently constrained during the association phase, the rule is successfully saved. Subsequently, when telemetry or log data matches the rule criteria, the detection engine generates alerts and automatically triggers the associated response actions against the matching managed hosts running the Elastic Defend integration. The payload behavior involves the execution of high-impact endpoint management functions, bypassing the intended security boundaries. The root cause is a failure to enforce principle-of-least-privilege checks across interdependent security components, allowing privilege escalation of functionality via indirect execution paths. The attack vector requires authenticated access to Kibana and relies on the automated execution mechanism of the detection engine to carry out the post-exploitation impact on managed endpoints without direct administrative interaction."
}