CVE-2026-56147

Received Received - Intake

Authorization Bypass in Kibana via User-Controlled Key

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Elastic

Description

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inconsistency in Kibana's file access authorization logic allows a low-privileged authenticated user to retrieve, modify, and delete case attachments that belong to feature areas they are not authorized to access. Because the access control check and the resource retrieval use different resolution mechanisms, an authenticated attacker with limited file management permissions can obtain the contents of, modify, or delete protected case attachments — such as those associated with Security Solution cases — without holding the privileges required to access those features.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-56147

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	kibana	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana. It allows low-privileged authenticated users to access, modify, or delete case attachments they are not authorized to view due to inconsistent authorization checks and resource retrieval mechanisms.

Impact Analysis

An attacker could exploit this to read sensitive case attachments, alter their contents, or delete them entirely. This could lead to data leaks, compromised case integrity, or unauthorized access to protected information.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to protected data. GDPR may require breach notification, while HIPAA could face penalties for unauthorized data exposure or integrity compromise.

Mitigation Strategies

Update Kibana to the latest patched version immediately to address the authorization bypass flaw. Review user permissions and restrict access to sensitive case attachments. Monitor for unauthorized access or modifications to attachments.

Hi! I’m here to help you understand CVE-2026-56147. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70