CVE-2025-68422
BaseFortify
Publication date: 2025-12-18
Last updated on: 2025-12-23
Assigner: Elastic
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| elastic | kibana | From 7.0.0 (inc) to 7.17.29 (inc) |
| elastic | kibana | From 8.0.0 (inc) to 8.19.7 (exc) |
| elastic | kibana | From 9.0.0 (inc) to 9.1.7 (exc) |
| elastic | kibana | 9.2.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an improper authorization issue in Kibana that allows an authenticated user to bypass permission restrictions by sending a specially crafted HTTP request. Specifically, it enables a user without the 'live queries - read' permission to retrieve the list of live queries, effectively escalating their privileges.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing unauthorized access to information that should be restricted, potentially exposing sensitive live query data. This privilege escalation could lead to information disclosure and undermine the security controls intended to protect data within Kibana.