What is the CVSS score of CVE-2026-63143?

CVE-2026-63143 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Kibana CVE-2026-63143

EUVD-2026-47580 MEDIUM

Missing Authorization (CWE-862)

2026-07-21 security@elastic.co

GHSA-wrjj-v99g-x4f7

Authentication Bypass Information Disclosure Elastic Kibana

4.3

CVSS 3.1 · Vendor: elastic

Severity by source

Vendor (elastic) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

PR:L confirmed by description (valid low-privilege account required); C:L appropriate as disclosure is bounded to workflow output data within the user's space; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (elastic).

CVSS VectorVendor: elastic

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:59 vuln.today

CVE Published

Jul 21, 2026 - 23:18 cve.org

MEDIUM 4.3

DescriptionCVE.org

Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The accessible data may include sensitive information returned by workflow steps, such as results from connected data sources that the caller would not otherwise be authorized to access.

AnalysisAI

Unauthorized access to workflow execution outputs in Kibana 9.3.0-9.3.7 and 9.4.0-9.4.3 allows an authenticated low-privileged user to read sensitive data returned by workflow steps - including results from connected data sources they are not authorized to query - by directly calling the workflow output endpoint without the authorization the documented API requires. The flaw is classified as Missing Authorization (CWE-862) via Privilege Abuse (CAPEC-122), with impact limited to confidentiality within the user's accessible Kibana space. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; Elastic has released patched versions 9.3.8 and 9.4.4.

Technical ContextAI

Kibana is Elastic's browser-based analytics, visualization, and workflow automation platform, part of the widely deployed Elastic Stack. The vulnerability resides in the server-side handler for the workflow execution output API: it retrieves and returns workflow step results without enforcing the authorization checks that the API's documented access model mandates (CWE-862). Kibana's workflow automation feature integrates with external data sources and APIs; execution outputs can therefore contain query results, API responses, or other sensitive records from systems the calling user does not hold authorization to access directly. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N confirms the flaw is reachable over the network with low complexity, requires only a low-privileged Kibana account, and produces a bounded confidentiality impact with no integrity or availability consequences. CAPEC-122 (Privilege Abuse) accurately characterizes the pattern: a legitimately authenticated user exploits an absent server-side check to access data beyond their granted privilege level.

RemediationAI

Upgrade Kibana to version 9.3.8 (if on the 9.3.x branch) or 9.4.4 (if on the 9.4.x branch) as detailed in Elastic security advisory ESA-2026-67 at https://discuss.elastic.co/t/kibana-9-3-8-9-4-4-security-update-esa-2026-67/388569. These releases introduce the missing server-side authorization checks on the workflow execution output endpoint. If an immediate upgrade is not operationally feasible, consider restricting Kibana space membership so that only users explicitly authorized to view workflow outputs are added to spaces containing sensitive automation workflows - note this may affect legitimate access to other dashboards within those spaces. Additionally, audit low-privileged user accounts for unexpected space membership and review workflow configurations to assess whether execution outputs contain data from privileged data sources. No workaround fully substitutes for patching, as the authorization gap exists at the API layer.