Kibana CVE-2026-63262

Exploitation requires a valid, authenticated Kibana account with at least low-level access to one Kibana Space (PR:L confirmed by CVSS vector). The attacker does not need elevated or administrative privileges - any active user account on the Kibana instance suffices. The vulnerability is present in multi-space Kibana deployments running versions 9.4.0 through 9.4.3; single-space deployments where the Spaces feature is not leveraged for isolation would not expose cross-space data even if the authorization bypass is triggered. No special configuration, non-default feature flag, or specific protocol is required beyond having Kibana Spaces in use. Exploitation is network-accessible (AV:N) with no victim interaction required. Unauthenticated external attackers without any Kibana account cannot exploit this vulnerability.

The 4.3 CVSS score reflects a limited, read-only confidentiality impact with no integrity or availability consequences, consistent with data disclosure rather than code execution. The CVSS vector (AV:N/AC:L/PR:L/UI:N) signals low exploitation complexity for any authenticated Kibana user - no elevated privileges, no victim interaction, no complex preconditions beyond having a valid account. Real-world risk is bounded by the authentication requirement (PR:L): unauthenticated external attackers cannot exploit this directly. However, in multi-tenant Kibana deployments - common in enterprise logging and observability stacks - a low-trust user in one space could traverse isolation boundaries to read sensitive data from other spaces, which may include security event data, financial dashboards, or business intelligence content. No EPSS data was supplied, KEV status is absent, and no POC is known, suggesting this is not currently subject to active opportunistic exploitation. The primary risk is insider threat or privilege escalation within an enterprise Kibana deployment.

An authenticated Kibana user with access to a low-sensitivity space crafts a network request containing a user-controlled reference to a saved object or resource belonging to a different, restricted space. Because the authorization check is missing, the server returns the cross-space resource without verifying the requester's permissions for that space, allowing the attacker to enumerate and read dashboards, index patterns, or other saved objects from spaces they should have no access to.