What is the CVSS score of CVE-2026-63259?

CVE-2026-63259 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Kibana CVE-2026-63259

EUVD-2026-47585 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-21 security@elastic.co

GHSA-vv4j-vm47-33w3

Information Disclosure Elastic Authentication Bypass Kibana

4.3

CVSS 3.1 · Vendor: elastic

Severity by source

Vendor (elastic) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible IDOR requiring a valid authenticated session (PR:L); impact is read-only partial confidentiality loss scoped to scheduled query results, no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (elastic).

CVSS VectorVendor: elastic

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:58 vuln.today

CVE Published

Jul 21, 2026 - 23:18 cve.org

MEDIUM 4.3

DescriptionCVE.org

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the requester is not authorized to access.

AnalysisAI

Kibana's multi-tenancy Spaces model can be bypassed through an Insecure Direct Object Reference (IDOR) vulnerability, allowing authenticated users to read scheduled query results belonging to Spaces they are not authorized to access. Affected versions span Kibana 9.4.0 through 9.4.3, with the fix delivered in 9.4.4. The CVSS vector (PR:L, C:L) confirms the impact is limited to low-privilege authenticated access resulting in partial confidentiality loss - no integrity or availability impact is involved. No public exploit code exists and no CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Kibana Spaces is an Elastic-native multi-tenancy feature that logically isolates dashboards, saved objects, and query data between organizational units within a single Kibana instance. CWE-639 (Authorization Bypass Through User-Controlled Key) describes an Insecure Direct Object Reference pattern where the application uses attacker-controllable identifiers - in this case, identifiers referencing scheduled query result objects - to fetch backend resources without adequately verifying that the requester holds access rights to the target Space. Because the identifier is trusted at the API layer without re-validating Space membership, a user legitimately authenticated to one Space can reference and retrieve data stored in a different, restricted Space. The affected surface is scoped to scheduled query results specifically, not the broader Kibana object model. Elastic reported this through their own security disclosure address (security@elastic.co), tracked externally as ENISA EUVD-2026-47585.

RemediationAI

Upgrade Kibana to version 9.4.4 or later, which contains the vendor-released fix per ESA-2026-70 (https://discuss.elastic.co/t/kibana-9-4-4-security-update-esa-2026-70/388573). This is the primary and recommended remediation path. If an immediate upgrade is operationally blocked, consider restricting access to the Kibana API endpoints that serve scheduled query results to trusted network segments or authenticated service accounts only, using Elastic's built-in role-based access control to reduce the user population that can issue API requests. Additionally, auditing Kibana role assignments to minimize the number of accounts granted any Space access reduces the potential attacker pool. Note that these workarounds do not eliminate the underlying IDOR condition and should be treated as temporary compensating controls only. No patch version other than 9.4.4 is confirmed in the available data.