CVE-2026-82302
Received Received - Intake

Incorrect Authorization in Kibana via Misconfigured Access Controls

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: Elastic

Description
Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-04
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-82302
EUVD
EUVD-2026-70663

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
elastic kibana *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Incorrect Authorization issue (CWE-863) in Kibana that allows unauthorized configuration changes. It can be exploited through incorrectly configured access control security levels (CAPEC-180), enabling attackers with limited privileges to modify settings they should not access.

Detection Guidance

To detect CVE-2026-82302, check if your Kibana instance is running a vulnerable version (8.19.20 or earlier, 9.4.5 or earlier, or 9.5.2 or earlier). Verify if Fleet and agent policy management are enabled. If so, the system may be affected.

Impact Analysis

An attacker could exploit this to alter Kibana configurations, potentially leading to data exposure, unauthorized access to sensitive information, or disruption of services. The high impact on confidentiality and integrity (CVSS 8.1) indicates significant risk for affected systems.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles or HIPAA's security requirements. Non-compliance risks include legal penalties, reputational damage, and loss of trust due to potential data breaches.

Mitigation Strategies

Update Kibana to the latest patched version immediately to address the Incorrect Authorization vulnerability. Review and restrict access controls to prevent unauthorized configuration changes. Monitor logs for suspicious activities related to access control modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82302. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart