CVE-2026-63145

Analyzed Analyzed - Analysis Complete

Incorrect Authorization in Kibana Leading to ML Record Tampering

Publication date: 2026-07-21

Last updated on: 2026-08-03

Assigner: Elastic

Description

Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A vulnerability exists in Kibana's Machine Learning functionality where a Machine Learning management endpoint performs an insufficient authorization check. The endpoint validates only a coarse privilege level but does not verify that the requesting user has access to the specific Machine Learning job or notification resources provided in the request. As a result, a low-privileged user with Machine Learning access in any Kibana space can manipulate Machine Learning audit and notification records for arbitrary jobs—including jobs in other spaces or belonging to other users—by leveraging Kibana's internally elevated credentials to write to restricted Machine Learning system indices that the user cannot access directly.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-03

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-63145

EUVD

EUVD-2026-47584

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	kibana	From 9.0.0 (inc) to 9.3.8 (exc)
elastic	kibana	From 9.4.0 (inc) to 9.4.4 (exc)
elastic	kibana	From 7.14.0 (inc) to 8.19.19 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability is an Incorrect Authorization issue in Kibana's Machine Learning feature. It allows low-privileged users with Machine Learning access to manipulate audit and notification records for any job, even those in other spaces or belonging to other users, by exploiting insufficient authorization checks in a management endpoint.

Detection Guidance

To detect this vulnerability, check if your Kibana instance is running a vulnerable version (8.19.18 or earlier, 9.3.7 or earlier, 9.4.3 or earlier). Use commands like 'curl -XGET http://localhost:5601/api/status' to check the version. If the version is vulnerable, upgrade to 8.19.19, 9.3.8, or 9.4.4 or later.

Impact Analysis

An attacker could modify or delete critical audit logs and notifications, potentially hiding malicious activity or disrupting operations. This could lead to undetected breaches or compliance violations due to tampered records.

Compliance Impact

This vulnerability could compromise compliance by allowing unauthorized alteration of audit trails and notifications, which are often required for regulatory reporting and evidence of proper controls under standards like GDPR and HIPAA.

Mitigation Strategies

Update Kibana to the latest patched version immediately to address the authorization flaw in Machine Learning functionality. Restrict access to Machine Learning endpoints and system indices to only authorized users. Review and audit all Machine Learning jobs and notification records for unauthorized modifications.

Hi! I’m here to help you understand CVE-2026-63145. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70