This vulnerability in Elastic Kibana allows a user with limited Fleet privileges to bypass authorization controls on an internal API endpoint. The endpoint improperly returns full configuration objects containing sensitive data such as private keys and authentication tokens, which should only be accessible to users with higher-level settings privileges. The flaw arises because the endpoint does not enforce the authorization checks that dedicated settings APIs implement, leading to privilege abuse and potential information disclosure. The issue affects Kibana versions 8.0.0, 9.0.0, and 9.3.0. The CVSS 3.1 base score is 7.7, reflecting a network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality impact with no impact on integrity or availability. No patch or official remediation level has been published by Elastic as of the vulnerability disclosure date.

An attacker with limited Fleet privileges can retrieve sensitive configuration data, including private keys and authentication tokens, that should be restricted to higher-privileged users. This leads to a confidentiality breach but does not affect system integrity or availability. The exposure of such sensitive credentials could facilitate further unauthorized access or lateral movement within the environment if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Fleet user privileges to trusted personnel only and monitor for unusual access patterns related to configuration endpoints. Avoid granting Fleet privileges broadly. Follow Elastic's official communications for updates on remediation.