What is the CVSS score of CVE-2026-49092?

CVE-2026-49092 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Kibana CVE-2026-49092

EUVD-2026-46385 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-21 elastic

GHSA-2529-45pr-jcrg

Information Disclosure Authentication Bypass Elastic Kibana

4.3

CVSS 3.1 · Vendor: elastic

Severity by source

Vendor (elastic) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable web app, low complexity; PR:L because a valid Kibana account is required; C:L for partial unauthorized data disclosure; no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (elastic).

CVSS VectorVendor: elastic

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 20:02 vuln.today

CVE Published

Jul 21, 2026 - 19:28 cve.org

MEDIUM 4.3

DescriptionCVE.org

Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, a lower-privileged user can cause data from sources they are not authorized to access to be processed using another user's privileges.

AnalysisAI

Kibana's authorization layer fails to enforce ACLs correctly in certain code paths, allowing a lower-privileged authenticated user to cause data from restricted Elasticsearch sources to be processed under another user's elevated privileges - effectively a confused deputy attack resulting in unauthorized information disclosure. The CVSS 4.3 (Medium) rating reflects low confidentiality impact and the requirement for a valid Kibana account, but the real-world risk is material in multi-tenant or role-segregated deployments where data isolation is a compliance requirement. No active exploitation confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.

Technical ContextAI

Kibana is Elastic's web-based visualization and analytics front-end for Elasticsearch, widely deployed as part of the Elastic (ELK) stack. The root cause is CWE-441 (Unintended Proxy or Intermediary - Confused Deputy), where Kibana acts as a server-side intermediary between the user and Elasticsearch. In the vulnerable code paths, Kibana uses the credentials or session context of a higher-privileged user to fulfill a request initiated by a lower-privileged one, bypassing the row-level security or index-level privileges enforced by Elasticsearch's role-based access control. This maps to CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs), indicating that specific Kibana features - likely dashboards, saved searches, alerting, or reporting pipelines - forward requests to Elasticsearch without re-validating the calling user's authorization against the target data source. The NVD CWE listing also references CWE-863 (Incorrect Authorization), confirming the authorization check itself is either absent or insufficient for this path. The affected CPE cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:* covers all Kibana versions, with the fix landing in 9.4.3.

RemediationAI

Upgrade Kibana to version 9.4.3 or later, which addresses this vulnerability per Elastic security advisory ESA-2026-54 (https://discuss.elastic.co/t/kibana-9-4-3-security-update-esa-2026-54/388553). If immediate patching is not feasible, consider restricting Kibana access to only fully-trusted users by temporarily removing low-privilege roles until the patch can be applied - this eliminates the attacker prerequisite of a low-privilege account, though it disrupts normal operations. Elasticsearch-level index privilege enforcement (document-level security, field-level security) can serve as a defense-in-depth control that limits what data is exposed even if the confused deputy path is triggered; enabling these Elasticsearch features adds a second authorization layer independent of Kibana's. Monitor Kibana audit logs for anomalous cross-index access patterns by lower-privileged accounts as a detection measure. No additional workarounds are documented in available data.