EUVD-2026-58278
GHSA-48hh-vcm6-636v
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-accessible Kibana web API (AV:N), no special conditions (AC:L), authenticated low-privilege account required (PR:L), integrity-only impact on case records (I:L), no confidentiality or availability effect.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
2DescriptionCVE.org
Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of case data by an authenticated user who has not been granted case editing privileges, via Manipulating User-Controlled Variables (CAPEC-77). Object attributes accepted by the case management API were not subject to the same authorization enforcement applied in the user interface, so a low-privileged user could alter case records they were only entitled to view.
AnalysisAI
Elastic Security's case management API in Kibana fails to enforce the same authorization controls applied in the UI, allowing authenticated low-privileged users to modify case records they are only entitled to view. The vulnerability arises from a mass-assignment flaw (CWE-915/CAPEC-77) where the API accepts object attributes that bypass privilege checks enforced at the UI layer - a classic server-side trust boundary mismatch. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Kibana user account with at least view-level permissions on the Elastic Security case management feature - the account must have read access to cases but lack explicit case-editing privileges. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 4.3 Medium (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) accurately characterizes the limited blast radius: exploitation requires a valid authenticated session (PR:L), yields only low integrity impact on case records (I:L), and has no confidentiality or availability dimension. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to upgrade Kibana to the patched versions identified in vendor advisory ESA-2026-110, available at https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-security-update-esa-2026-110/389523. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. Rated criti
Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. Rated hig
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. Rated critical s
Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP
Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are us
A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine lea
Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. Rated critical sever
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. Rate
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document con
Kibana version 8.7.0 contains an arbitrary code execution flaw. Rated high severity (CVSS 8.8), this vulnerability is re
Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. Rated high severity (CVSS 8.8), this vulne
Kibana versions up to 9.3.0 contains a vulnerability that allows attackers to read arbitrary files from the Kibana serve
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today