Description
Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints.
Affected products
elastic: kibana
References1
- discuss.elastic.co/t/kibana-9-3-8-9-4-4-security-update-esa-202… Vendor Advisory
Metrics
- CVSS 3.1
-
5.4
MEDIUM
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - EPSS — exploit probability
- 0% percentile: 14 · as of 14 November 2026
- CWE
- CWE-862
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.