Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Information Disclosure and Case Attachment Integrity Compromise
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inconsistency in Kibana's file access authorization logic allows a low-privileged authenticated user to retrieve, modify, and delete case attachments that belong to feature areas they are not authorized to access. Because the access control check and the resource retrieval use different resolution mechanisms, an authenticated attacker with limited file management permissions can obtain the contents of, modify, or delete protected case attachments — such as those associated with Security Solution cases — without holding the privileges required to access those features.
Affected Versions:
- 8.x: All versions from 8.7.0 up to and including 8.19.17
- 9.x:
- All versions from 9.0.0 up to and including 9.3.6
- All versions from 9.4.0 up to and including 9.4.2
Users on Kibana 8.0.0 through 8.6.x are not affected. The file management functionality that contains this vulnerability was introduced in 8.7.0 and is not present in earlier versions. Users on the 9.5.x release line are not affected; the fix was incorporated before the first 9.5.x release.
Affected Configurations:
- Kibana deployments where users have been granted Files Management or Shared Images feature access are affected. Deployments where no users hold Files Management or Shared Images feature access are not at risk.
Solutions and Mitigations:
The issue is resolved in versions 8.19.18, 9.3.7, and 9.4.3.
For Users that Cannot Upgrade:
- There are no workarounds for this vulnerability.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.
Severity: CVSSv3.1: High ( 7.1 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVE ID: CVE-2026-56147
Problem Type: CWE-639 - Authorization Bypass Through User-Controlled Key
Impact: CAPEC-122 - Privilege Abuse