CVE-2026-63145
Summary
by MITRE • 07/22/2026
Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1).
A vulnerability exists in Kibana's Machine Learning functionality where a Machine Learning management endpoint performs an insufficient authorization check. The endpoint validates only a coarse privilege level but does not verify that the requesting user has access to the specific Machine Learning job or notification resources provided in the request. As a result, a low-privileged user with Machine Learning access in any Kibana space can manipulate Machine Learning audit and notification records for arbitrary jobs—including jobs in other spaces or belonging to other users—by leveraging Kibana's internally elevated credentials to write to restricted Machine Learning system indices that the user cannot access directly.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability described represents a critical authorization flaw classified as CWE-863, which specifically addresses incorrect authorization conditions where a subject is granted access to objects based on insufficient privilege checks. This weakness manifests within Kibana's machine learning functionality and constitutes a significant threat to data integrity and system security. The flaw enables unauthorized manipulation of audit and notification records through what is termed CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs, indicating that access controls are inadequately enforced at the application level.
Kibana's machine learning management endpoint demonstrates a fundamental failure in privilege validation by performing only coarse-grained authorization checks rather than verifying specific resource access permissions. This architectural weakness allows a low-privileged user who possesses basic machine learning access within any Kibana space to exploit the system's internally elevated credentials for unauthorized operations. The vulnerability operates on the principle that while users may have general access to machine learning functionality, they should not be permitted to manipulate records belonging to other users or jobs outside their designated scope.
The technical execution of this flaw relies on the system's use of internally elevated credentials that bypass normal access restrictions. When a user makes requests to modify machine learning audit and notification records, the system leverages these elevated privileges to write to restricted system indices. However, the authorization check fails to validate whether the requesting user legitimately owns or has permissions for the specific job or notification being modified, creating a direct pathway for privilege escalation and unauthorized data manipulation.
The operational impact of this vulnerability extends beyond simple unauthorized access to encompass complete integrity compromise of machine learning audit trails and notification systems. Attackers can manipulate audit records to hide malicious activities or create false notifications that could mislead administrators about system status. This capability undermines the fundamental security posture of organizations relying on Kibana for monitoring and alerting, as compromised audit trails provide no reliable evidence of actual system behavior.
This vulnerability aligns with ATT&CK technique T1566 which covers credential harvesting and privilege escalation through application-level attacks. The flaw demonstrates how insufficient authorization controls in enterprise applications can create attack vectors for lateral movement and data tampering within security monitoring systems. Organizations using Kibana's machine learning features face significant risk of undetected malicious activities and compromised forensic capabilities, as audit records become unreliable indicators of system integrity.
Mitigation strategies should focus on implementing proper resource-level authorization checks that validate both user privileges and specific object access permissions before allowing modifications to machine learning jobs or notifications. The implementation must ensure that each request undergoes comprehensive authorization validation rather than relying solely on coarse privilege levels. Security teams should consider deploying additional monitoring for machine learning system indices and implementing least-privilege access controls for all Kibana users, particularly those with elevated capabilities in machine learning functions.