ElasticCVE-2026-63143
Elastic Kibana: missing authorization
Medium4.3CVE-2026-63143 · Published Jul 21, 2026 · updated Aug 3, 2026
Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The accessible data may include sensitive information returned by workflow steps, such as results from connected data sources that the caller would not otherwise be authorized to access.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Kibana Product | >= 9.4.0, <= 9.4.3 | No fix yet |
| >= 9.3.0, <= 9.3.7 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-862
More Elastic advisories
All Elastic| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 21 | Elastic Kibana: improper authorization | Medium5.0 | No fix yet |
| Jul 21 | Elasticsearch: denial of service | Medium6.5 | No fix yet |
| Jul 21 | Elastic Kibana: improper authorization | Medium4.3 | No fix yet |
| Jul 21 | Elastic Kibana: information disclosure | Medium4.3 | No fix yet |
| Jul 21 | Elastic Kibana: resource exhaustion | Medium6.5 | No fix yet |
| Jul 21 | Elastic Kibana: resource exhaustion | Medium6.5 | No fix yet |