8.3
High
CVE-2026-63137 Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured…
Description
Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). A user holding workflow edit permissions could cause scheduled workflow executions to run with the privileges of a different, higher-privileged user, allowing access to and modification of data beyond their own authorization scope.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Kibana 9.3 | 9.3.0 → 9.4.2 | No fix stated |
Other CVEs of Kibana
The 196 CVEs of Kibana →
CVE-2026-115295
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing…
4.3
Medium
CVE-2026-115294
Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in the Kibana Fleet feature can lead to…
7.3
High
CVE-2026-115293
Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure of…
6.5
Medium
CVE-2026-115292
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information disclosure…
4.3
Medium