This vulnerability (CWE-639) in Kibana involves an authorization bypass through a user-controlled key, allowing authenticated users with limited file management permissions to retrieve, modify, or delete case attachments belonging to unauthorized feature areas. The root cause is an inconsistency between the access control check and the resource retrieval mechanisms, which do not align properly. As a result, an attacker can bypass intended access restrictions and compromise case attachment confidentiality and integrity without having the required privileges for those features.

An attacker with low privileges can access sensitive case attachments they should not be authorized to view or modify, leading to unauthorized information disclosure and integrity compromise of case attachments. This impacts confidentiality and integrity but does not affect availability. The vulnerability specifically threatens protected case attachments, including those associated with Security Solution cases.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict access to Kibana to trusted users and review permissions to minimize exposure. Avoid granting unnecessary file management permissions to low-privileged users.