Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2026-63141

Missing Authorization in Kibana Leading to Unauthorized Access to Cloud Connect Management Functions

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
elastic

Description

Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Elastic Kibana

Default version status: unaffected

  • 9.4.0 to ≤ 9.4.3affected
  • 9.3.0 to ≤ 9.3.7affected

References