What is the CVSS score of CVE-2026-56147?

CVE-2026-56147 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Kibana are affected by CVE-2026-56147?

Elastic Kibana contains an authorization bypass vulnerability enabling authenticated users with limited permissions to access, modify, and delete sensitive Security Solution case attachments.

How to fix or mitigate CVE-2026-56147?

Within 24 hours, audit your Kibana deployments to identify affected instances and immediately restrict case attachment access to essential personnel only. Within 7 days, contact Elastic Support for interim mitigation guidance and implement comprehensive audit logging on all case attachment operations to detect unauthorized modifications. Establish a 30-day timeline to deploy official remediation once Elastic releases guidance, and conduct a full security audit of case attachments accessed or modified during the exposure period.

Kibana CVE-2026-56147

EUVD-2026-46403 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-21 elastic

GHSA-83mc-f7wh-6hxj

Information Disclosure Authentication Bypass Elastic Kibana

7.1

CVSS 3.1 · Vendor: elastic

Severity by source

Vendor (elastic) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Primary rating from Vendor (elastic) · only source for this CVE.

CVSS VectorVendor: elastic

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 21:01 vuln.today

CVE Published

Jul 21, 2026 - 20:14 cve.org

HIGH 7.1

DescriptionCVE.org

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inconsistency in Kibana's file access authorization logic allows a low-privileged authenticated user to retrieve, modify, and delete case attachments that belong to feature areas they are not authorized to access. Because the access control check and the resource retrieval use different resolution mechanisms, an authenticated attacker with limited file management permissions can obtain the contents of, modify, or delete protected case attachments - such as those associated with Security Solution cases - without holding the privileges required to access those features.

AnalysisAI

Unauthorized information disclosure and case-attachment tampering in Elastic Kibana lets a low-privileged authenticated user with limited file-management permissions read, alter, or delete case attachments belonging to feature areas they should not reach, including sensitive Security Solution cases. The flaw stems from Kibana's file-access authorization check and its resource retrieval using two different resolution mechanisms, allowing the authorization gate to be bypassed. No public exploit identified at time of analysis; not listed in CISA KEV, and EPSS was not provided.