CVE-2025-68386 — Kibana Improper Authorization

CVE-2025-68386

Kibana Improper Authorization PUBLISHED

Description (CNA)

Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not have permission to do so, making it visible to everyone in the space via a crafted a HTTP request.

Affected (CNA)

Vendor / product	Versions
Elastic / Kibana	affected 7.0.0 through 7.17.29; affected 8.0.0 through 8.19.7; affected 9.0.0 through 9.1.7; affected 9.2.0 through 9.2.1

CWE

CWE-863

References

https://discuss.elastic.co/t/kibana-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-38/384186

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.