Elastic Kibana EUVD-2026-87793

Requires an authenticated Kibana user account that has been granted the Timeline feature privilege within a Kibana space (PR:L). Read/enumeration/disclosure of other users' draft Timeline objects requires only Timeline read access; modification and deletion additionally require the Timeline write privilege. Exploitation is limited to draft Timeline objects belonging to other users in the SAME Kibana space, so the flaw is only meaningful in multi-user shared-space deployments where Timeline privileges are granted to more than one principal - a single-user space or environments that do not use the Timeline feature are not exposed. No user interaction from the victim is needed.

This is a genuine but moderate-severity issue, best characterized as a same-space, cross-user authorization bypass (CWE-639 / IDOR) rather than a critical break. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, base 6.3) is internally consistent with the description: exploitation is network-reachable and low-complexity, but requires an authenticated Kibana user who has already been granted the Timeline feature privilege in a space (PR:L), and impact is limited to draft Timeline objects belonging to other users in that same space (Low confidentiality, integrity, and availability). No EPSS score, CISA KEV entry, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are aligned rather than conflicting: a high-fidelity vendor advisory (Elastic ESA-2026-103) with a moderate CVSS and no exploitation indicators points to a real but non-urgent patch-management priority - an insider/multi-tenant data-integrity concern, not an internet-facing pre-auth RCE. The main caveats are that PR:L is only meaningful where multiple users share a Kibana space and Timeline privileges are broadly granted, and that write/modify/delete impact requires the additional Timeline write privilege (read-only users can still enumerate and disclose).

An authenticated Kibana user who has been granted the Timeline feature privilege within a shared space enumerates and reads draft Timeline objects created by other analysts in that same space, disclosing investigation data they should not see. If that same user also holds the Timeline write privilege, they can modify or delete other users' draft Timelines, tampering with or destroying colleagues' work. No public exploit code was identified at time of analysis.