CVE-2026-63141 PUBLISHED

Missing Authorization in Kibana Leading to Unauthorized Access to Cloud Connect Management Functions

Assigner: elastic
Reserved: 15.07.2026 Published: 21.07.2026 Updated: 21.07.2026

Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS Score: 6.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	Low	Integrity Impact	Low
User Interaction	None	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	Elastic
Product	Kibana
Versions	Default: unaffected affected from 9.4.0 to 9.4.3 (incl.) affected from 9.3.0 to 9.3.7 (incl.)

References

https://discuss.elastic.co/t/kibana-9-3-8-9-4-4-security-update-esa-2026-65/388566

Problem Types

CWE-862 Missing Authorization CWE

Impacts

CAPEC-122 Privilege Abuse