CVE-2026-63137: Incorrect Authorization in Kibana Leading to Privilege Escalation
Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). A user holding workflow edit permissions could cause scheduled workflow executions to run with the privileges of a different, higher-privileged user, allowing access to and modification of data beyond their own authorization scope.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Kibana deployments where users have workflow edit permissions are exposed. The issue requires the presence of scheduled workflows that can execute under a different, higher-privileged user's privileges.
What does an attacker need to exploit it?
An attacker needs an existing Kibana account with workflow edit permissions. No user interaction is required, and the vulnerability is network-accessible according to the provided vector.
What could an attacker do after exploitation?
The attacker could cause scheduled workflow executions to run with a higher-privileged user's permissions. This can allow access to and modification of data outside the attacker's authorized scope.