CyberRota Analysis
AI-GeneratedKibana is vulnerable to incorrect authorization, allowing users with workflow edit permissions to escalate privileges and execute scheduled workflows under the authority of higher-privileged users. This flaw can lead to unauthorized access and modification of sensitive data, posing a significant risk to data integrity and confidentiality. Organizations using Kibana should prioritize addressing this vulnerability to prevent potential exploitation and safeguard their data.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). A user holding workflow edit permissions could cause scheduled workflow executions to run with the privileges of a different, higher-privileged user, allowing access to and modification of data beyond their own authorization scope.
Related CVEs
Other vulnerabilities affecting the same vendor(s)