Kibana EUVD-2026-70661

Exploitation requires a valid Kibana account with at minimum low-level privileges (PR:L in the CVSS vector) - fully unauthenticated exploitation is not possible. The vulnerability is reachable over the network without user interaction once authenticated. The specific misconfigured access-control path is not described in public disclosures; the affected code path or feature within Kibana is unconfirmed from available data. What limits exploitation: the attacker must possess valid credentials, availability impact is rated Low (A:L) rather than High, and there is no confidentiality or integrity impact. Non-default configurations or specific Kibana feature flags are not identified as prerequisites.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L yields a Medium score of 4.3, accurately reflecting that exploitation requires valid low-privileged credentials and produces only a low-magnitude availability impact. The EPSS score is not provided in available data, and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed in-the-wild exploitation. There is no known public proof-of-concept. The combination of authenticated-only access and a limited availability impact substantially constrains real-world risk - even a mid-sized municipal IT team in gdynia running a shared Kibana instance would face meaningful disruption only if their user population includes potentially hostile or careless internal accounts. The SSVC signals point to 'Track' rather than 'Act': the flaw is not automatable without credentials, scope is limited to the Kibana process itself (S:U), and the integrity/confidentiality impact is nil. The 'Authentication Bypass' tag in the input metadata is misleading - this is an authorization flaw (CWE-863), not an authentication bypass - and should not inflate perceived severity.

An authenticated Kibana user holding a low-privileged role - such as a read-only analyst or a service account - crafts requests that exercise an access-control boundary the application fails to properly enforce, triggering resource exhaustion or an error condition that degrades Kibana availability for other users. Because no public exploit code has been identified, exploitation would require independent discovery of the specific misconfigured endpoint or operation. The low attack complexity (AC:L) implies no race conditions or specialized knowledge beyond valid credentials once the vulnerable path is identified.