Description

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kibana privileges to indirectly cause a background task to read from Elasticsearch indices that user is not authorized to access. Derived entity data from those indices is then exposed through the entity store output.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-02T15:17:41.277Z",
  "pubdate": "2026-09-02T15:17:41.277Z",
  "executiveSummary": "This vulnerability involves a Missing Authorization flaw (CWE-862) within the Kibana Entity Store configuration mechanism. The issue allows an authenticated user with elevated Kibana privileges to bypass standard access controls, resulting in unauthorized information disclosure via Privilege Abuse (CAPEC-122).\nBy manipulating specific configuration operations, an attacker can coerce background tasks into interacting with Elasticsearch indices that fall outside the attacker's authorized scope. This action effectively escalates the attacker's data retrieval capabilities beyond their assigned permissions. The derived data is subsequently surfaced through the Entity Store output, exposing sensitive index content.\nThe vulnerability poses significant risk to data confidentiality, as it facilitates unauthorized access to restricted Elasticsearch data stores. Successful exploitation requires the attacker to hold elevated Kibana privileges, though it does not necessitate direct administrative access to the underlying Elasticsearch instance. The impact is primarily categorized as unauthorized information disclosure, potentially leading to the leakage of PII, internal system metadata, or protected application data. Organizations should prioritize remediation by applying official security updates to the affected Kibana instances to enforce strict authorization checks on entity store operations.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of authorization controls within the Kibana Entity Store configuration API. Specifically, the component responsible for processing configuration updates fails to validate whether the requester possesses sufficient permissions to perform operations against target indices when those operations are offloaded to background execution tasks.\nThe attack flow initiates when an authenticated user, possessing elevated Kibana privileges, interacts with the Entity Store configuration interface. By crafting a specific configuration payload, the user influences the parameters under which the background worker executes. Because the authorization logic is decoupled from the actual execution of the background task, the system fails to propagate the user's restricted security context to the database query layer.\nWhen the background task triggers, it operates with higher-level system permissions rather than the user's scoped context. This allows the process to perform READ operations on Elasticsearch indices that the initiating user is not explicitly authorized to view. The Entity Store then processes this retrieved data, transforming it into its final structured output format.\nThe vulnerable component is the Kibana Entity Store, which serves as an intermediary layer for data processing and aggregation. The vulnerability essentially allows for a confused deputy scenario where the Entity Store acts as a proxy for the authenticated user to query restricted Elasticsearch indices. Since the data is returned via the standard Entity Store output, the attacker can retrieve the result sets through legitimate, authorized API endpoints, effectively masking the illicit query activity.\nExploitation prerequisites include authenticated access to the Kibana platform and the possession of elevated privileges within the Kibana environment. While the attacker does not require direct credentials for the backend Elasticsearch cluster, the misconfiguration of the Kibana service allows the attacker to leverage the service account's existing connection to the backend. The vulnerability underscores a failure in the 'principle of least privilege' during the handover between user-initiated configuration and automated background task processing. Subsequent exploitation results in persistent data exposure as long as the malicious configuration remains active, allowing for ongoing data exfiltration or automated reconnaissance of protected indices."
}