This vulnerability involves improper limitation of a pathname to a restricted directory (CWE-22) in Kibana's dashboard management functionality. Specifically, an authenticated user with limited privileges can craft a dashboard identifier that, when deleted by an administrator, causes the deletion request to be redirected internally to an unintended endpoint. This redirection can result in unauthorized deletion of user accounts or other resources. The vulnerability affects Kibana versions 8.0.0 and 9.0.0. Exploitation requires user interaction by an administrator performing the delete action. The CVSS v3.1 base score is 4.6 (medium severity), reflecting network attack vector, low complexity, limited privileges required, and user interaction needed, with no confidentiality impact but limited integrity and availability impacts.

The impact includes potential unauthorized deletion of user accounts or other resources within Kibana due to the path traversal redirecting delete requests to unintended internal endpoints. There is no confidentiality impact reported. The integrity impact is limited to unauthorized deletions, and availability impact is limited to potential resource removal. Exploitation requires an administrator to delete a maliciously crafted dashboard, so the risk depends on administrative actions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, administrators should exercise caution when deleting dashboards, especially those created by users with limited permissions. Monitoring and restricting dashboard creation permissions may reduce risk until a fix is released.