What is the CVSS score of CVE-2026-63262?

CVE-2026-63262 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Kibana CVE-2026-63262

EUVD-2026-47590 MEDIUM

Missing Authorization (CWE-862)

2026-07-22 security@elastic.co

GHSA-9pm3-74f7-q229

Authentication Bypass Elastic Information Disclosure Kibana

4.3

CVSS 3.1 · Vendor: elastic

Severity by source

Vendor (elastic) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible Kibana requires low-privilege authentication (PR:L); only limited confidentiality impact via cross-space read; no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (elastic).

CVSS VectorVendor: elastic

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:12 vuln.today

CVE Published

Jul 22, 2026 - 00:17 cve.org

MEDIUM 4.3

DescriptionCVE.org

Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control.

AnalysisAI

Cross-space information disclosure in Kibana 9.4.0 through 9.4.3 allows authenticated users to access data from Kibana Spaces they are not authorized to view. The flaw (CWE-862, Missing Authorization) arises because user-supplied input can reference cross-space resources without adequate space-level authorization checks, enabling privilege boundary bypass within a multi-tenant Kibana deployment. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Kibana Spaces is an Elastic feature providing logical multi-tenancy within a single Kibana instance, isolating saved objects such as dashboards, index patterns, and visualizations between organizational units or teams. CWE-862 (Missing Authorization) indicates the application fails to verify whether the authenticated user holds the required space-level permissions before fulfilling a request involving cross-space resource references. Because user-supplied input (e.g., a space identifier, object reference, or query parameter) is processed without adequate authorization enforcement, an attacker can craft requests that reference resources belonging to spaces outside their permitted scope. The CVSS vector (AV:N/PR:L) confirms the vulnerability is exploitable remotely by any authenticated Kibana user with even a low-privileged account on the affected instance.

RemediationAI

Upgrade to Kibana 9.4.4, which addresses this vulnerability per Elastic Security Advisory ESA-2026-73 at https://discuss.elastic.co/t/kibana-9-4-4-security-update-esa-2026-73/388576. If immediate upgrade is not feasible, restrict Kibana access to trusted internal users only and enforce network-level controls to prevent external or low-trust users from reaching the Kibana interface, noting that this does not eliminate the flaw for users who retain legitimate access. Space administrators should audit Space permissions and minimize the number of users with access to sensitive spaces, as tighter access control reduces the blast radius of cross-space data exposure. There are no confirmed vendor-documented workarounds beyond patching.