CVE-2026-63137 — Incorrect Authorization in Kibana Leading to Privilege Escalation
Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). A user holding wor…
Published: 2026-09-01 · CVSS: 8.3 · CVSS 3.1
Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). A user holding workflow edit permissions could cause scheduled workflow executions to run with the privileges of a different, higher-privileged user, allowing access to and modification of data beyond their own authorization scope.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7