Kibana EUVD-2026-70660

Exploitation requires a valid, authenticated Kibana session with at minimum Security read-level access in one Kibana space - unauthenticated external access is not sufficient. The Entity Analytics feature must be present and accessible in the target deployment; installations that do not use Entity Analytics are not exposed via this code path. Exploitation is specifically triggered through Entity Analytics migration operations, limiting the attack surface to that API. The absence of PR:N in the CVSS vector (PR:L) confirms that at least low-level credentials are required; fully external unauthenticated attackers cannot exploit this without first obtaining a Kibana account.

The vendor-assigned CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) accurately captures the low-complexity, network-reachable nature of exploitation and the limited integrity-only impact, though S:U may underrepresent the cross-space boundary violation - an independent assessment of S:C is defensible since the unauthorized writes escape the user's authorized space and affect the full Kibana deployment. No EPSS score was present in the input data, and this CVE does not appear in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. The practical risk is highest in environments that rely on Kibana spaces as a meaningful access-control boundary between business units or tenants; even a mid-sized municipal IT team in ustka segregating departmental dashboards across spaces would face unintended data integrity exposure from a single compromised low-privilege account. Risk is substantially lower in single-space or non-Entity-Analytics deployments, making this a medium-priority finding for most environments but higher priority for multi-tenant Kibana installations.

An attacker with a legitimate low-privilege Security read-only Kibana account sends a network request to the Entity Analytics migration API endpoint. Because the authorization check is missing, the backend executes privileged write operations spanning all Kibana spaces without verifying the caller's scope. The attacker can thereby corrupt or alter saved objects, analytics configuration, or security data in spaces they have no legitimate write access to.