This vulnerability (CVE-2026-49092) in Elastic Kibana 9.4.0 is classified as CWE-863 (Incorrect Authorization) and involves a confused deputy problem (CWE-441). Under certain conditions, a lower-privileged user can exploit the flaw to have data from sources they are not authorized to access processed using another user's privileges, effectively bypassing access control lists (ACLs). The CVSS 3.1 base score is 4.3 (medium), reflecting limited impact on confidentiality and no impact on integrity or availability. No patch or remediation level is currently provided by the vendor, and no known exploits are reported in the wild.

The vulnerability allows unauthorized information exposure by enabling a lower-privileged user to indirectly access data they should not be authorized to see. It does not affect data integrity or system availability. The attack vector is network-based with low privileges required and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, monitor Elastic's advisories for updates. Until a fix is released, consider restricting access to Kibana 9.4.0 instances to trusted users only and review user privileges to minimize exposure.