CVE-2026-63145— Elastic kibana 授权问题漏洞

Incorrect Authorization in Kibana Leading to Machine Learning Audit Log Integrity Compromise

Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A vulnerability exists in Kibana's Machine Learning functionality where a Machine Learning management endpoint performs an insufficient authorization check. The endpoint validates only a coarse privilege level but does not verify that the requesting user has access to the specific Machine Learning job or notification resources provided in the request. As a result, a low-privileged user with Machine Learning access in any Kibana space can manipulate Machine Learning audit and notification records for arbitrary jobs—including jobs in other spaces or belonging to other users—by leveraging Kibana's internally elevated credentials to write to restricted Machine Learning system indices that the user cannot access directly.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

授权机制不正确

Elastic kibana 授权问题漏洞

Elastic kibana是荷兰Elastic公司开源的一个数据可视化平台。 Elastic kibana 8.0.0至8.19.18及之前版本、9.0.0至9.3.7及之前版本和9.4.0至9.4.3及之前版本存在授权问题漏洞，该漏洞源于Machine Learning管理端点授权检查不足，仅验证粗略权限级别而未检查用户对特定Machine Learning job或通知资源的访问权限，可能导致低权限用户利用内部提升的凭据操纵任意job的Machine Learning审计和通知记录。

N/A

N/A