# Security Announcements **URL:** https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=6 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 7 --- ## [Kibana 8.19.10, 9.1.10, 9.2.4 Security Update (ESA-2026-04)](https://discuss.elastic.co/t/kibana-8-19-10-9-1-10-9-2-4-security-update-esa-2026-04/384522)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [January 13, 2026, 8:47pm UTC](https://discuss.elastic.co/t/kibana-8-19-10-9-1-10-9-2-4-security-update-esa-2026-04/384522 "2026-01-13T20:47:06Z")
Allocation of Resources Without Limits or Throttling in Kibana Fleet (ESA-2026-04) Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specia… --- ## [Kibana 8.19.10, 9.1.10, 9.2.4 Security Update (ESA-2026-03)](https://discuss.elastic.co/t/kibana-8-19-10-9-1-10-9-2-4-security-update-esa-2026-03/384521)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [January 13, 2026, 8:45pm UTC](https://discuss.elastic.co/t/kibana-8-19-10-9-1-10-9-2-4-security-update-esa-2026-03/384521 "2026-01-13T20:45:44Z")
Allocation of Resources Without Limits or Throttling in Kibana Leading to Excessive Allocation (ESA-2026-03) Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocatio… --- ## [Packetbeat 8.19.10, 9.1.10, 9.2.4 Security Update (ESA-2026-02)](https://discuss.elastic.co/t/packetbeat-8-19-10-9-1-10-9-2-4-security-update-esa-2026-02/384520)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [January 13, 2026, 8:43pm UTC](https://discuss.elastic.co/t/packetbeat-8-19-10-9-1-10-9-2-4-security-update-esa-2026-02/384520 "2026-01-13T20:43:19Z")
Improper Validation of Array Index in Packetbeat Leading to Overflow Buffers (ESA-2026-02) Improper Validation of Array Index (CWE-129) in Packetbeat’s MongoDB protocol parser can allow an attacker to cause Overflow Buff… --- ## [Metricbeat 8.19.10, 9.1.10, 9.2.4 Security Update (ESA-2026-01)](https://discuss.elastic.co/t/metricbeat-8-19-10-9-1-10-9-2-4-security-update-esa-2026-01/384519)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [January 13, 2026, 8:42pm UTC](https://discuss.elastic.co/t/metricbeat-8-19-10-9-1-10-9-2-4-security-update-esa-2026-01/384519 "2026-01-13T20:42:48Z")
Improper Input Validation in Metricbeat Leading to Denial of Service (ESA-2026-01) Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service via Input Data Mani… --- ## [Kibana 8.19.7, 9.1.7, and 9.2.1 Security Update (ESA-2025-39)](https://discuss.elastic.co/t/kibana-8-19-7-9-1-7-and-9-2-1-security-update-esa-2025-39/384187)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [December 18, 2025, 9:28pm UTC](https://discuss.elastic.co/t/kibana-8-19-7-9-1-7-and-9-2-1-security-update-esa-2025-39/384187 "2025-12-18T21:28:59Z")
Kibana Improper Authorization (ESA-2025-39) Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restrictions via a craf… --- ## [Kibana 8.19.8, 9.1.8, and 9.2.2 Security Update (ESA-2025-38)](https://discuss.elastic.co/t/kibana-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-38/384186)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [December 18, 2025, 9:28pm UTC](https://discuss.elastic.co/t/kibana-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-38/384186 "2025-12-18T21:28:18Z")
Kibana Improper Authorization (ESA-2025-38) Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even… --- ## [Elasticsearch 8.19.8, 9.1.8, and 9.2.2 Security Update (ESA-2025-37)](https://discuss.elastic.co/t/elasticsearch-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-37/384185)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [December 18, 2025, 9:27pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-37/384185 "2025-12-18T21:27:04Z")
Elasticsearch Allocation of Resources Without Limits or Throttling (ESA-2025-37) Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore priv… --- ## [Kibana 8.19.9, 9.1.9, and 9.2.3 Security Update (ESA-2025-36)](https://discuss.elastic.co/t/kibana-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-36/384184)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [December 18, 2025, 9:26pm UTC](https://discuss.elastic.co/t/kibana-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-36/384184 "2025-12-18T21:26:25Z")
Kibana Allocation of Resources Without Limits or Throttling (ESA-2025-36) Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocat… --- ## [Kibana 8.19.9, 9.1.9, and 9.2.3 Security Update (ESA-2025-35)](https://discuss.elastic.co/t/kibana-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-35/384183)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [December 18, 2025, 9:25pm UTC](https://discuss.elastic.co/t/kibana-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-35/384183 "2025-12-18T21:25:42Z")
Kibana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (ESA-2025-35) Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthent… --- ## [Kibana 8.19.9, 9.1.9, and 9.2.3 Security Update (ESA-2025-34)](https://discuss.elastic.co/t/kibana-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-34/384182)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [December 18, 2025, 9:24pm UTC](https://discuss.elastic.co/t/kibana-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-34/384182 "2025-12-18T21:24:54Z")
Kibana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (ESA-2025-34) Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authentic… --- ## [Elasticsearch 8.19.9, 9.1.9, and 9.2.3 Security Update (ESA-2025-33)](https://discuss.elastic.co/t/elasticsearch-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-33/384181)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [December 18, 2025, 9:17pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-33/384181 "2025-12-18T21:17:50Z")
Elasticsearch Allocation of Resources Without Limits or Throttling (ESA-2025-33) Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Exc… --- ## [Filebeat 8.19.9, 9.1.9, and 9.2.3 Security Update (ESA-2025-32)](https://discuss.elastic.co/t/filebeat-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-32/384180)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [December 18, 2025, 9:16pm UTC](https://discuss.elastic.co/t/filebeat-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-32/384180 "2025-12-18T21:16:47Z")
Filebeat Improper Validation of Specified Index, Position, or Offset in Input (ESA-2025-32) Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285) in Filebeat Syslog parser and the Libbeat Disse… --- ## [Packetbeat 8.19.9, 9.1.9, and 9.2.3 Security Update (ESA-2025-31)](https://discuss.elastic.co/t/packetbeat-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-31/384179)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [December 18, 2025, 9:16pm UTC](https://discuss.elastic.co/t/packetbeat-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-31/384179 "2025-12-18T21:16:04Z")
Packetbeat Out-of-bounds Read (ESA-2025-31) Out-of-bounds read (CWE-125) allows an unauthenticated remote attacker to perform a buffer overflow (CAPEC-100) via the NFS protocol dissector, leading to a denial-of-service … --- ## [Packetbeat 8.19.9, 9.1.9, and 9.2.3 Security Update (ESA-2025-30)](https://discuss.elastic.co/t/packetbeat-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-30/384178)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [December 18, 2025, 9:15pm UTC](https://discuss.elastic.co/t/packetbeat-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-30/384178 "2025-12-18T21:15:08Z")
Packetbeat Improper Bounds Check (ESA-2025-30) Improper Bounds Check (CWE-787) in Packetbeat can allow a remote unauthenticated attacker to exploit a Buffer Overflow (CAPEC-100) and reliably crash the application or cau… --- ## [Packetbeat 8.19.9, 9.1.9, and 9.2.3 Security Update (ESA-2025-29)](https://discuss.elastic.co/t/packetbeat-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-29/384177)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [December 18, 2025, 9:13pm UTC](https://discuss.elastic.co/t/packetbeat-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-29/384177 "2025-12-18T21:13:38Z")
Packetbeat Allocation of Resources Without Limits or Throttling (ESA-2025-29) Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excessive allocation (CAPEC… --- ## [Kibana 8.19.8, 9.1.8, and 9.2.2 Security Update (ESA-2025-28)](https://discuss.elastic.co/t/kibana-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-28/384064)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [December 15, 2025, 10:15am UTC](https://discuss.elastic.co/t/kibana-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-28/384064 "2025-12-15T10:15:09Z")
Kibana Cross-site Scripting via the Integration Package Upload Functionality (ESA-2025-28) Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to re… --- ## [Elasticsearch 8.19.8, 9.1.8, and 9.2.2 Security Update (ESA-2025-27)](https://discuss.elastic.co/t/elasticsearch-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-27/384063)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [December 15, 2025, 10:14am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-27/384063 "2025-12-15T10:14:49Z")
Elasticsearch Improper Authentication (ESA-2025-27) Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a… --- ## [Kibana 8.19.7, 9.1.7, and 9.2.1 Security Update (ESA-2025-24)](https://discuss.elastic.co/t/kibana-8-19-7-9-1-7-and-9-2-1-security-update-esa-2025-24/383381)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [November 12, 2025, 9:41am UTC](https://discuss.elastic.co/t/kibana-8-19-7-9-1-7-and-9-2-1-security-update-esa-2025-24/383381 "2025-11-12T09:41:39Z")
Kibana Origin Validation Error (ESA-2025-24) Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant. Affected Versions: 8… --- ## [Kibana 8.19.7, 9.1.7, 9.2.1 Security Update (ESA-2025-25)](https://discuss.elastic.co/t/kibana-8-19-7-9-1-7-9-2-1-security-update-esa-2025-25/383379)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [November 12, 2025, 9:33am UTC](https://discuss.elastic.co/t/kibana-8-19-7-9-1-7-9-2-1-security-update-esa-2025-25/383379 "2025-11-12T09:33:52Z")
Kibana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (ESA-2025-25) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Kibana can lead to DOM-ba… --- ## [Elastic Defend 8.19.6, 9.1.6, and 9.2.0 Security Update (ESA-2025-23)](https://discuss.elastic.co/t/elastic-defend-8-19-6-9-1-6-and-9-2-0-security-update-esa-2025-23/383272)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [November 6, 2025, 2:25pm UTC](https://discuss.elastic.co/t/elastic-defend-8-19-6-9-1-6-and-9-2-0-security-update-esa-2025-23/383272 "2025-11-06T14:25:08Z")
Elastic Defend Improper Preservation of Permissions (ESA-2025-23) Improper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary files on the system being deleted by the Defend service run… --- ## [Elastic Cloud Enterprise (ECE) 3.8.3 and 4.0.3 Security Update (ESA-2025-22)](https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-3-and-4-0-3-security-update-esa-2025-22/383132)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [October 31, 2025, 5:36pm UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-3-and-4-0-3-security-update-esa-2025-22/383132 "2025-10-31T17:36:53Z")
Elastic Cloud Enterprise Improper Authorization (ESA-2025-22) Improper Authorization in Elastic Cloud Enterprise can lead to Privilege Escalation where the built-in readonly user can call APIs that should not be allowed… --- ## [Elastic Cloud Enterprise (ECE) 3.8.2 and 4.0.2 Security Update (ESA-2025-21)](https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-2-and-4-0-2-security-update-esa-2025-21/382641)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [October 13, 2025, 1:44pm UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-2-and-4-0-2-security-update-esa-2025-21/382641 "2025-10-13T13:44:01Z")
Elastic Cloud Enterprise (ECE) Improper Neutralization of Special Elements Used in a Template Engine (ESA-2025-21) Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) … --- ## [Kibana 8.18.8, 8.19.5, 9.0.8, and 9.1.5 Security Update (ESA-2025-20)](https://discuss.elastic.co/t/kibana-8-18-8-8-19-5-9-0-8-and-9-1-5-security-update-esa-2025-20/382449)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [October 6, 2025, 4:20pm UTC](https://discuss.elastic.co/t/kibana-8-18-8-8-19-5-9-0-8-and-9-1-5-security-update-esa-2025-20/382449 "2025-10-06T16:20:21Z")
Kibana Cross-Site Scripting (XSS) (ESA-2025-20) Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload. Affected Versions: 7.x: All versions prior to and inc… --- ## [Kibana - Crowdstrike Connector 8.18.8, 8.19.5, 9.0.8, and 9.1.5 Security Update (ESA-2025-19)](https://discuss.elastic.co/t/kibana-crowdstrike-connector-8-18-8-8-19-5-9-0-8-and-9-1-5-security-update-esa-2025-19/382455)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [October 6, 2025, 4:44pm UTC](https://discuss.elastic.co/t/kibana-crowdstrike-connector-8-18-8-8-19-5-9-0-8-and-9-1-5-security-update-esa-2025-19/382455 "2025-10-06T16:44:50Z")
Kibana Insufficiently Protected Credentials in the CrowdStrike Connector (ESA-2025-19) Insufficiently Protected Credentials in the Crowdstrike connector can lead to Crowdstrike credentials being leaked. A malicious user… --- ## [Elasticsearch 8.18.8, 8.19.5, 9.0.8, 9.1.5 Security Update (ESA-2025-18)](https://discuss.elastic.co/t/elasticsearch-8-18-8-8-19-5-9-0-8-9-1-5-security-update-esa-2025-18/382453)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [October 6, 2025, 4:40pm UTC](https://discuss.elastic.co/t/elasticsearch-8-18-8-8-19-5-9-0-8-9-1-5-security-update-esa-2025-18/382453 "2025-10-06T16:40:57Z")
Elasticsearch Insertion of sensitive information in log file (ESA-2025-18) Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing r… --- ## [Kibana 8.18.8, 8.19.5, 9.0.8, 9.1.5 Security Update (ESA-2025-17)](https://discuss.elastic.co/t/kibana-8-18-8-8-19-5-9-0-8-9-1-5-security-update-esa-2025-17/382451)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [October 6, 2025, 4:29pm UTC](https://discuss.elastic.co/t/kibana-8-18-8-8-19-5-9-0-8-9-1-5-security-update-esa-2025-17/382451 "2025-10-06T16:29:00Z")
Kibana Stored Cross-Site-Scripting(XSS) (ESA-2025-17) Improper Validation of Specified Type of Input in Kibana can lead to stored Cross-Site-Scripting (XSS) Affected Versions: 7.x: All versions from 7.0.0 and up to a… --- ## [Kibana 8.18.8, 8.19.4, 9.0.7, 9.1.4 Security Update (ESA-2025-16)](https://discuss.elastic.co/t/kibana-8-18-8-8-19-4-9-0-7-9-1-4-security-update-esa-2025-16/382450)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [October 6, 2025, 4:24pm UTC](https://discuss.elastic.co/t/kibana-8-18-8-8-19-4-9-0-7-9-1-4-security-update-esa-2025-16/382450 "2025-10-06T16:24:59Z")
Kibana Cross-Site-Scripting (XSS) (ESA-2025-16) Improper Neutralization of Input During Web Page Generation in Vega visualizations in Kibana can lead to Cross-Site-Scripting (XSS) Affected Versions: 7.x: All versions… --- ## [Enterprise Search 8.18.6, 8.19.3 Security Update (ESA-2025-15) (CVE-2025-54988)](https://discuss.elastic.co/t/enterprise-search-8-18-6-8-19-3-security-update-esa-2025-15-cve-2025-54988/381428)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [August 28, 2025, 3:39pm UTC](https://discuss.elastic.co/t/enterprise-search-8-18-6-8-19-3-security-update-esa-2025-15-cve-2025-54988/381428 "2025-08-28T15:39:46Z")
Enterprise Search XML external entity (XXE) injection in Apache Tika (ESA-2025-15) On August 20, 2025, CVE-2025-54988 in Apache Tika PDF parser module was announced, disclosing an XML External Entity injection flaw in t… --- ## [Elasticsearch 8.18.6, 8.19.3, 9.0.6, and 9.1.3 Security Update (ESA-2025-14) (CVE-2025-54988)](https://discuss.elastic.co/t/elasticsearch-8-18-6-8-19-3-9-0-6-and-9-1-3-security-update-esa-2025-14-cve-2025-54988/381427)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [August 28, 2025, 3:38pm UTC](https://discuss.elastic.co/t/elasticsearch-8-18-6-8-19-3-9-0-6-and-9-1-3-security-update-esa-2025-14-cve-2025-54988/381427 "2025-08-28T15:38:52Z")
Elasticsearch XML external entity (XXE) injection in Apache Tika (ESA-2025-14) On August 20, 2025, CVE-2025-54988 in Apache Tika PDF parser module was announced, disclosing an XML External Entity injection flaw in the A… --- ## [Kibana 9.0.6, 9.1.3 Security Update (ESA-2025-13)](https://discuss.elastic.co/t/kibana-9-0-6-9-1-3-security-update-esa-2025-13/381426)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [August 28, 2025, 3:35pm UTC](https://discuss.elastic.co/t/kibana-9-0-6-9-1-3-security-update-esa-2025-13/381426 "2025-08-28T15:35:08Z")
Kibana privilege escalation via reporting\_user role (ESA-2025-13) Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting\_user role which incorrectly has the ability to access all K… [Previous page](https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=5) [Next page](https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=7)