Description

Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only low-privilege Security feature access could invoke an administrative operation that creates and persists Elasticsearch API keys under the caller's identity, bypassing the elevated cluster and Kibana privileges that the documented Entity Store setup flow requires.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-01T20:17:23.510Z",
  "pubdate": "2026-09-01T20:17:23.510Z",
  "executiveSummary": "A vulnerability classified as CWE-862 (Missing Authorization) exists within the Kibana Entity Store feature, specifically concerning how the system enforces Access Control Lists (ACLs).\nThis flaw permits authenticated, low-privilege users to execute administrative functions that would otherwise require elevated cluster and Kibana privileges.\nThe primary impact of this vulnerability is the unauthorized creation and persistence of Elasticsearch API keys, which are generated under the identity of the low-privileged attacker.\nBy bypassing the intended security constraints of the Entity Store setup flow, an attacker can effectively escalate their functional reach within the Elasticsearch cluster.\nThe exploitation of this vulnerability is limited to authenticated users; however, the lack of sufficient authorization checks allows these users to perform operations outside their assigned roles.\nThe risk implication is significant, as the ability to generate persistent API keys can facilitate long-term unauthorized access and potential lateral movement within the data environment, undermining the integrity of the cluster's access management framework.",
  "technicalDetails": "The root cause of this vulnerability lies in an insufficient authorization check within the Kibana Entity Store component, which fails to validate the caller's permissions against the required ACLs for sensitive administrative tasks.\nSpecifically, the application logic that handles the entity storage operations neglects to enforce appropriate privilege checks, mapping directly to CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs).\nUnder normal operating conditions, the Entity Store setup flow is designed to require elevated cluster privileges and specific Kibana administrative rights to authorize the creation of Elasticsearch API keys.\nThe vulnerability manifests because the endpoint or function responsible for triggering the key creation does not perform a secondary validation of the user's authorization level prior to interacting with the Elasticsearch backend.\nAn attack flow begins with an authenticated user possessing only low-privilege access to the Security feature. The attacker interacts with the Entity Store API, invoking a function meant for system-level configuration. Because the backend service assumes that the request is authorized based on the session token alone—without validating the specific functional permissions—it processes the request.\nThe system subsequently interfaces with the Elasticsearch API to generate an API key. Since this action is performed within the context of the user's session, the resulting key is tethered to the identity of the low-privileged attacker, granting them programmatic access to Elasticsearch resources that they would normally be barred from accessing.\nThis behavior represents a failure in the application's authorization boundary. The persistent nature of these generated keys allows an attacker to maintain access even if their original session is terminated or their low-privileged user account is restricted.\nThe vulnerability does not require the bypass of external network controls, as it is exploitable via internal API calls facilitated by an authenticated session. The technical impact is the compromise of the principle of least privilege, enabling functional escalation through the misuse of a legitimate administrative workflow."
}