CVE-2025-68422

MEDIUM

Elastic Kibana < 7.17.29 - Incorrect Authorization

Title source: rule

Description

Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This allows an attacker who lacks the live queries - read permission to successfully retrieve the list of live queries.

References (1)

[Vendor Advisory] https://discuss.elastic.co/t/kibana-8-19-7-9-1-7-and-9-2-1-security-update-esa-2025-39/384187

Scores

CVSS v3 4.3

EPSS 0.0003

EPSS Percentile 9.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Classification

CWE

CWE-863

Status published

Affected Products (2)

elastic/kibana < 7.17.29

elastic/kibana

Timeline

Published Dec 18, 2025

Tracked Since Feb 18, 2026