CVE-2026-63262

Analyzed Analyzed - Analysis Complete

Missing Authorization in Kibana Leads to Information Disclosure

Publication date: 2026-07-22

Last updated on: 2026-08-03

Assigner: Elastic

Description

Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-08-03

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-63262

EUVD

EUVD-2026-47590

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	kibana	From 9.4.0 (inc) to 9.4.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-63262 is a Missing Authorization vulnerability in Kibana versions 9.4.0 to 9.4.3. It allows unauthorized cross-space information disclosure when an authenticated user with the slo_read privilege exploits user-supplied input to bypass space-level access controls.

Detection Guidance

To detect this vulnerability, check if your Kibana version is between 9.4.0 and 9.4.3. Run: curl -s http://localhost:5601/api/status | grep version. If the version is in this range, the system is potentially vulnerable.

Impact Analysis

An attacker with slo_read privileges could access sensitive information across spaces they are not authorized to view. This could lead to data leaks in multi-space environments where Kibana SLO features are enabled.

Compliance Impact

This vulnerability could lead to unauthorized data access, potentially violating GDPR (data protection) and HIPAA (health information privacy) by exposing sensitive information without proper authorization.

Mitigation Strategies

Upgrade Kibana to version 9.4.4 or later immediately. If using Elastic Cloud Serverless, the patch is already applied. No workarounds exist for affected versions.

Hi! I’m here to help you understand CVE-2026-63262. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70