Elastic Kibana EUVD-2026-116076

Requires an authenticated Kibana account that already holds read access to connectors in at least one space, and a multi-space Kibana deployment where connector execution logs exist in other spaces. Exploitation is limited to disclosure of connector execution log metadata - connector names and identifiers, execution status, timestamps, error messages, and aggregated execution statistics - with no integrity or availability impact. Limiting factors: a valid low-privilege account is mandatory (PR:L, no anonymous access), the flaw only matters where separate spaces are used for access segregation, and only metadata (not connector secrets or primary data) is exposed. The exact API endpoint or parameter serving as the user-controlled key is not described in the available sources.

This is a genuine but low-urgency issue rather than a high-severity emergency. The CVSS 3.1 base score is 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, meaning network-reachable but requiring an authenticated account (PR:L) and yielding only limited confidentiality impact (C:L) with no integrity or availability effect. The vuln.today decision label is 'this_month', consistent with a moderate-priority patch cadence rather than act_now/emergency. There is no CISA KEV listing and no EPSS score supplied in the input, so widespread or automated exploitation is not indicated; combined with 'no public exploit identified at time of analysis', the real-world threat is cross-space metadata leakage by an already-authenticated low-privilege user, not an externally weaponizable flaw. The signals are internally consistent: the authorization-bypass (CWE-639) mechanism, the PR:L authenticated prerequisite, and the C:L/I:N/A:N impact all align with a contained information-disclosure defect. EPSS and KEV data are absent from the input, so exploitation probability cannot be quantified beyond the qualitative signals above.

An authenticated Kibana user who holds read access to connectors within their own space issues API requests for connector execution log data scoped to other Kibana spaces they should not be able to see. Because access is keyed on a user-controllable identifier without enforcing space-level ACLs, Kibana returns connector names, IDs, execution statuses, timestamps, error messages, and aggregated statistics from those other spaces. No public exploit code is identified at time of analysis, and exploitation requires a valid low-privilege account (PR:L) over the network (AV:N) with low complexity.