# Kibana 8.14.0 Security Update (ESA-2024-15)

**URL:** <https://discuss.elastic.co/t/kibana-8-14-0-security-update-esa-2024-15/360887>\
**Category:** Security Announcements\
**Created:** [June 5, 2024, 8:45pm UTC](https://discuss.elastic.co/t/kibana-8-14-0-security-update-esa-2024-15/360887 "2024-06-05T20:45:39Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![rodrigo\_silva](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rodrigo_silva/32/120546_2.png) [@rodrigo\_silva](https://discuss.elastic.co/u/rodrigo_silva)\
**Post date:** [June 5, 2024, 8:45pm UTC](https://discuss.elastic.co/t/kibana-8-14-0-security-update-esa-2024-15/360887/1 "2024-06-05T20:45:40Z")

</div>

**Kibana Broken Access Control issue (ESA-2024-15)**

A flaw was discovered in Kibana, allowing `view-only` users of alerting to use the `run_soon` API making the alerting rule run continuously, potentially affecting the system availability if the alerting rule is running complex queries.

**Affected Versions:**  
Kibana versions 8.6.3 through 8.13.4.

**Solutions and Mitigations:**  
The issue is resolved in version 8.14.0.

**Severity:** CVSSv3: 4.3(Medium) - AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

**CVE ID:** CVE-2024-37279

---

_[View the full topic](https://discuss.elastic.co/t/kibana-8-14-0-security-update-esa-2024-15/360887)._