Description

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding minimal Elasticsearch privileges could bypass Kibana feature authorization and space access controls, resulting in the unauthorized disclosure of Fleet deployment metadata from the default Kibana space.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-01T20:17:23.637Z",
  "pubdate": "2026-09-01T20:17:23.637Z",
  "executiveSummary": "A Missing Authorization vulnerability (CWE-862) exists within Kibana, allowing authenticated users with minimal Elasticsearch privileges to circumvent established feature authorization and space-based access controls.\nThis vulnerability facilitates the unauthorized disclosure of sensitive Fleet deployment metadata residing within the default Kibana space.\nThe flaw stems from an incorrect implementation of access control security levels, categorized under CAPEC-180, which fails to enforce strict boundaries for restricted Kibana features.\nThe impact is significant, as it allows low-privileged entities to gain visibility into infrastructure configuration details that should be restricted to administrators or authorized users.\nSuccessful exploitation requires the attacker to possess an active authenticated session, albeit with insufficient privileges to typically access such information.\nRisk implications include potential reconnaissance against the Fleet management infrastructure, potentially exposing deployment topologies, agent configurations, or other metadata that could aid further targeted attacks.",
  "technicalDetails": "The vulnerability resides in the authorization middleware and access control layer governing Kibana feature access and multi-tenancy (Spaces).\nThe root cause is a failure in the application logic to correctly validate the effective permissions of the requesting user against the requested resource, specifically regarding Fleet deployment metadata endpoints.\nEven when users are restricted via Elasticsearch-level privileges, Kibana’s internal authorization checks are bypassed, allowing access to resources outside their designated security context.\nThe attack flow proceeds as follows: 1. An authenticated user with limited privileges initiates a request to a Kibana API endpoint responsible for serving Fleet deployment metadata. 2. The Kibana application fails to correctly verify the user's authorization to access the specific Fleet feature or the data scoped within the default space. 3. The server erroneously processes the request, assuming the session satisfies the internal requirements, despite the lack of explicit authorization. 4. The application returns sensitive deployment metadata to the unauthorized user.\nThis vulnerability corresponds to CAPEC-180, 'Exploiting Incorrectly Configured Access Control Security Levels,' where the application security architecture does not consistently enforce authorization checks across its feature set.\nThe vulnerable component is the Kibana authorization engine tasked with mediating access to Fleet management capabilities and space-specific data.\nExploitation requires the attacker to be authenticated to the target Kibana instance. While they require minimal Elasticsearch privileges, they do not require administrative or high-level permissions to access the sensitive Fleet information.\nThe primary post-exploitation impact is the unauthorized disclosure of information. Fleet metadata provides critical insights into the environment's managed assets, which may include deployment identifiers, connectivity details, and configuration status. This intelligence gathering significantly lowers the barrier for subsequent, more sophisticated attacks against the Fleet infrastructure or the managed agents."
}