CVE-2025-68422 — Kibana Improper Authorization

CVE-2025-68422

Kibana Improper Authorization PUBLISHED

Description (CNA)

Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This allows an attacker who lacks the live queries - read permission to successfully retrieve the list of live queries.

Affected (CNA)

Vendor / product	Versions
Elastic / Kibana	affected 7.0.0 through 7.17.29; affected 8.0.0 through 8.19.6; affected 9.0.0 through 9.1.6; affected 9.2.0 before 9.2.0

CWE

CWE-863

References

https://discuss.elastic.co/t/kibana-8-19-7-9-1-7-and-9-2-1-security-update-esa-2025-39/384187

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.