What is the CVSS score of CVE-2026-63141?

CVE-2026-63141 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Elastic Kibana CVE-2026-63141

EUVD-2026-46636 MEDIUM

Missing Authorization (CWE-862)

2026-07-21 elastic

GHSA-m95c-48mw-v3r3

Authentication Bypass Elastic Kibana

5.4

CVSS 3.1 · NVD

Severity by source

Vendor (elastic) PRIMARY

MEDIUM

qualitative

NVD

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

6.3 MEDIUM

Network-accessible API requiring only a low-privilege account; unchanged scope with Low C/I/A reflecting configuration read/write on a single feature.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (elastic).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Aug 06, 2026 - 15:52 NVD

6.3 (MEDIUM) 5.4 (MEDIUM)

Analysis Generated

Jul 21, 2026 - 22:01 vuln.today

CVE Published

Jul 21, 2026 - 21:08 cve.org

MEDIUM 6.3

DescriptionNVD

Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints.

AnalysisAI

Missing authorization controls in Kibana's Cloud Connect endpoints allow any authenticated low-privilege user to read and modify Cloud Connect configuration and service settings that should be restricted to users with specific feature privileges. Exploitation occurs via direct HTTP requests to insufficiently protected internal API endpoints, bypassing Kibana's privilege enforcement layer entirely. No public exploit code exists and this vulnerability is not listed in CISA KEV; however, the low barrier - requiring only a valid Kibana account - elevates practical risk in multi-tenant or externally accessible deployments.

Technical ContextAI

Kibana is Elastic's primary web-based visualization and management frontend for the Elastic Stack (Elasticsearch). Cloud Connect is a Kibana feature enabling integration with Elastic Cloud services and external cloud providers. CWE-862 (Missing Authorization) describes the root cause: specific API endpoints governing Cloud Connect configuration and service settings lack proper privilege checks, meaning the application does not verify whether the authenticated caller holds the required Kibana feature privilege before serving or accepting modifications. The affected product is identified by CPE cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*, covering all Kibana versions prior to the patched releases. The flaw is not an authentication bypass - Kibana's authentication is intact - but rather an authorization gap at the endpoint level where role-based feature privileges are not enforced.

RemediationAI

Upgrade Kibana to version 9.3.8 (on the 9.3.x branch) or 9.4.4 (on the 9.4.x branch), as confirmed by Elastic's security advisory ESA-2026-65 at https://discuss.elastic.co/t/kibana-9-3-8-9-4-4-security-update-esa-2026-65/388566. If an immediate upgrade is not feasible and the Cloud Connect feature is not actively used, disabling or restricting access to Cloud Connect configuration endpoints via network-layer controls (e.g., reverse proxy ACLs blocking direct access to the affected API paths) can reduce exposure. Restricting Kibana access to only trusted users and minimizing the number of accounts with any Kibana login access also reduces the available attacker pool, though this is a compensating control and not a substitute for patching.