CVE-2026-63259

Analyzed Analyzed - Analysis Complete

Authorization Bypass in Kibana via User-Supplied Identifiers

Publication date: 2026-07-21

Last updated on: 2026-08-03

Assigner: Elastic

Description

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the requester is not authorized to access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-03

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-63259

EUVD

EUVD-2026-47585

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	kibana	From 9.4.0 (inc) to 9.4.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana. It allows attackers to access scheduled query result data from Kibana Spaces they are not authorized to view by manipulating user-supplied identifiers.

Detection Guidance

To detect CVE-2026-63259, check if your Kibana instance is running version 9.4.0 through 9.4.3. Verify the Osquery Manager integration is enabled and multiple Kibana Spaces are configured. No specific commands are provided, but inspecting Kibana logs for unauthorized access to scheduled query results may indicate exploitation.

Impact Analysis

An attacker could exploit this to disclose sensitive information from restricted Kibana Spaces, potentially leading to unauthorized data access or leaks. The impact is limited to information disclosure as per the CVSS score.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Organizations may face legal penalties or reputational damage.

Mitigation Strategies

Update Kibana to the latest patched version immediately to address the authorization bypass issue. Review user access controls and permissions for scheduled query results to ensure proper authorization checks are in place.

Hi! I’m here to help you understand CVE-2026-63259. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70