This vulnerability (CVE-2026-33462) involves improper limitation of a pathname to a restricted directory (CWE-22) in Elastic Kibana's dashboard management functionality. A low-privileged authenticated user can create a dashboard with a specially crafted identifier. When an administrator attempts to delete this dashboard, the deletion request is redirected internally to an unintended endpoint, potentially causing unauthorized deletion of user accounts or other resources. Exploitation requires the administrator to perform the delete action on the malicious dashboard object. The issue affects Kibana versions 8.0.0 and 9.0.0. No patch or vendor advisory with remediation details is currently provided.

The vulnerability can lead to unauthorized deletion of user accounts or other resources within Kibana when an administrator deletes a maliciously crafted dashboard. There is no direct confidentiality impact reported, but integrity and availability impacts are possible due to unauthorized deletions. Exploitation requires both a low-privileged authenticated user to create the malicious dashboard and an administrator to perform the delete action, limiting the attack vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when deleting dashboards created by users with limited permissions. Monitoring and restricting dashboard creation permissions may reduce risk. No official remediation or temporary fix is currently documented.