Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2025-25010

Kibana privilege escalation via reporting_user role

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
elastic

Description

Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which incorrectly has the ability to access all Kibana Spaces.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Elastic Kibana

Default version status: unaffected

  • 9.0.0 to ≤ 9.0.5affected
  • 9.1.0 to ≤ 9.1.2affected

References