CVE-2026-82299
Received Received - Intake

Incorrect Authorization in Kibana Leads to Information Disclosure

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: Elastic

Description
Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-04
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-82299
EUVD
EUVD-2026-70662

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
elastic kibana *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Incorrect Authorization issue (CWE-863) in Kibana that allows information disclosure. It occurs due to incorrectly configured access control security levels (CAPEC-180), meaning unauthorized users might access sensitive data.

Detection Guidance

To detect CVE-2026-82299, check if your Kibana instance is running versions 9.0.0 through 9.4.5 or 9.5.0 through 9.5.2. Verify if Fleet debugging interfaces are enabled. Commands to check version: curl -X GET "http://localhost:5601/api/console/api_server" or check the Kibana version file. If enabled, the vulnerability may allow unauthorized information disclosure.

Impact Analysis

An attacker with low privileges could exploit this to access confidential information stored in Kibana, potentially leading to data breaches or unauthorized data exposure.

Compliance Impact

This vulnerability could violate compliance requirements like GDPR or HIPAA by enabling unauthorized access to protected data, leading to legal penalties, fines, or reputational damage.

Mitigation Strategies

Update Kibana to the latest version to address the Incorrect Authorization vulnerability. Ensure access control security levels are correctly configured to prevent unauthorized information disclosure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82299. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart