CVE-2026-63143

Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The accessible data may include sensitive information returned by workflow steps, such as results from connected data sources that the caller would not otherwise be authorized to access.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://discuss.elastic.co/t/kibana-9-3-8-9-4-4-security-update-esa-2026-67/388569	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:elastic:kibana::::::::
	cpe:2.3:a:elastic:kibana::::::::

History

24 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) La falta de autorización (CWE-862) en Kibana puede llevar a la revelación de información no autorizada a través de Abuso de Privilegios (CAPEC-122). Un usuario con privilegios de funciones limitados puede acceder a las salidas de ejecución de flujos de trabajo en su espacio de Kibana sin la autorización requerida para hacerlo a través de la API documentada. Los datos accesibles pueden incluir información sensible devuelta por los pasos del flujo de trabajo, como resultados de fuentes de datos conectadas a las que el llamador no estaría autorizado a acceder de otro modo.

Information

Published : 2026-07-21 23:18

Updated : 2026-10-24 17:10

NVD link : CVE-2026-63143

Mitre link : CVE-2026-63143

CVE.ORG link : CVE-2026-63143

JSON object : View

Products Affected

elastic

kibana

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-63143", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63143", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T13:30:59.002938Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@elastic.co", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@elastic.co", "affectedData": [{"vendor": "Elastic", "product": "Kibana", "versions": [{"status": "affected", "version": "9.4.0", "versionType": "semver", "lessThanOrEqual": "9.4.3"}, {"status": "affected", "version": "9.3.0", "versionType": "semver", "lessThanOrEqual": "9.3.7"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-21T23:18:02.230", "references": [{"url": "https://discuss.elastic.co/t/kibana-9-3-8-9-4-4-security-update-esa-2026-67/388569", "tags": ["Vendor Advisory"], "source": "security@elastic.co"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@elastic.co", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The accessible data may include sensitive information returned by workflow steps, such as results from connected data sources that the caller would not otherwise be authorized to access."}, {"lang": "es", "value": "La falta de autorizaci\u00f3n (CWE-862) en Kibana puede llevar a la revelaci\u00f3n de informaci\u00f3n no autorizada a trav\u00e9s de Abuso de Privilegios (CAPEC-122). Un usuario con privilegios de funciones limitados puede acceder a las salidas de ejecuci\u00f3n de flujos de trabajo en su espacio de Kibana sin la autorizaci\u00f3n requerida para hacerlo a trav\u00e9s de la API documentada. Los datos accesibles pueden incluir informaci\u00f3n sensible devuelta por los pasos del flujo de trabajo, como resultados de fuentes de datos conectadas a las que el llamador no estar\u00eda autorizado a acceder de otro modo."}], "lastModified": "2026-10-24T17:10:00.220", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DFA9A0A0-0868-43FB-8FBC-F6493C5B2110", "versionEndExcluding": "9.3.8", "versionStartIncluding": "9.0.0"}, {"criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE10B417-76BB-4C6D-8D1C-5B029497F013", "versionEndExcluding": "9.4.4", "versionStartIncluding": "9.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@elastic.co"}