1. Home
  2. CVE Database
  3. CVE-2026-63143
MEDIUM · 4.3

CVE-2026-63143

Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outputs ...

Vulnerability Description

Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The accessible data may include sensitive information returned by workflow steps, such as results from connected data sources that the caller would not otherwise be authorized to access.

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
ElasticKibana>= 9.0.0, < 9.3.8

Related Weaknesses (CWE)

CWE-862

References

FAQ

What is CVE-2026-63143?

CVE-2026-63143 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outputs ...

How severe is CVE-2026-63143?

CVE-2026-63143 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-63143?

Check the references section above for vendor advisories and patch information. Affected products include: Elastic Kibana.