Kibana EUVD-2026-20523

The CVSS score of 4.3 (Low severity) reflects the limited immediate impact: the attack requires prior authentication with Fleet management permissions (PR:L), operates over the network without user interaction (AV:N, AC:L, UI:N), and results only in confidentiality loss (C:L) with no integrity or availability impact (I:N, A:N). However, real-world risk is elevated by several factors: the vulnerability enables privilege escalation within a multi-tenant environment where users may be intentionally restricted to specific spaces for data governance or compliance reasons, the disclosed information (policy details, infrastructure links) can enable lateral movement or reconnaissance for targeted attacks, and the presence of a simple enrollment endpoint suggests likely ease of exploitation. The EPSS score is not provided, but exploitation probability is moderate given the straightforward nature of bypassing authorization checks via an existing endpoint. This is not a critical vulnerability by CVSS standards, but organizations with strict multi-space segregation policies should prioritize remediation due to the breach of intended access boundaries.

An authenticated Kibana user with Fleet agent management privileges in Space A logs in and crafts a request to the internal enrollment endpoint, specifying a policy identifier from Space B (obtained through reconnaissance or directory enumeration). The endpoint, lacking space validation, returns the full policy details without verifying the user's authorization to Space B, exposing infrastructure configuration and policy names. The attacker uses this information to understand the target environment's Fleet deployment and identify potential vulnerabilities or misconfigurations across spaces they should not access. No public proof-of-concept has been identified at time of analysis, but the straightforward nature of the authorization bypass (missing validation check on a standard endpoint) suggests exploitation is straightforward for threat actors with valid Kibana credentials.