CVE-2026-82299
published 2026-09-03CVE-2026-82299: Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).
PriorityP337medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.38%
31.0th percentile
Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | kibana | 9.0.0 – 9.4.5 | — |
| elastic | kibana | 9.5.0 – 9.5.2 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).
ghsa_unreviewed·2026-09-03
CVE-2026-82299 [MEDIUM] CWE-863 Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).
Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).
VulDB
Elastic Kibana up to 9.4.5/9.5.2 authorization
vuldb·2026-09-03·CVSS 6.5
CVE-2026-82299 [MEDIUM] Elastic Kibana up to 9.4.5/9.5.2 authorization
A vulnerability marked as problematic has been reported in Elastic Kibana up to 9.4.5/9.5.2. Affected by this vulnerability is an unknown functionality. This manipulation causes incorrect authorization.
This vulnerability appears as CVE-2026-82299. The attack may be initiated remotely. There is no available exploit.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-03
Published