CVE-2026-63141

MEDIUM

Missing Authorization in Kibana Leading to Unauthorized Access to Cloud Connect Management Functions

Title source: cna

Description

Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints.

References (1)

Core 1

Core References

https://discuss.elastic.co/t/kibana-9-3-8-9-4-4-security-update-esa-2026-65/388566

Scores

CVSS v3 6.3

EPSS 0.0020

EPSS Percentile 10.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (2)

Elastic/Kibana 9.3.0 - 9.3.7

Elastic/Kibana 9.4.0 - 9.4.3

Published Jul 21, 2026

Tracked Since Jul 22, 2026