CVE-2026-49092
published 2026-07-21CVE-2026-49092: Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly…
PriorityP423medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.28%
19.2th percentile
Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, a lower-privileged user can cause data from sources they are not authorized to access to be processed using another user's privileges.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | kibana | >= 9.4.0 < 9.4.3 | 9.4.3 |
| elastic | kibana | 9.4.0 – 9.4.2 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Elastic Kibana up to 9.4.2 ACL confused deputy
vuldb·2026-08-08·CVSS 4.3
CVE-2026-49092 [MEDIUM] Elastic Kibana up to 9.4.2 ACL confused deputy
A vulnerability has been found in Elastic Kibana up to 9.4.2 and classified as problematic. This impacts an unknown function of the component ACL. Performing a manipulation results in unintended intermediary.
This vulnerability is reported as CVE-2026-49092. The attack is possible to be carried out remotely. No exploit exists.
The affected component should be upgraded.
GHSA
Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1).
ghsa_unreviewed·2026-07-21
CVE-2026-49092 [MEDIUM] CWE-863 Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1).
Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, a lower-privileged user can cause data from sources they are not authorized to access to be processed using another user's privileges.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-21
Published