This vulnerability (CWE-863) in Elastic Kibana 9.4.0 involves incorrect authorization that enables users with limited privileges to modify watchlist data that should require elevated permissions. Additionally, in specific deployment scenarios, the flaw may lead to unauthorized information disclosure by allowing access to data outside the user's intended scope. The issue stems from improper access control mechanisms within the Entity Analytics Watchlist feature.

An attacker with low-privileged authenticated access and read-only Security Solution permissions can perform unauthorized write operations on watchlist configurations, potentially altering security monitoring data. Furthermore, under certain deployment conditions, the attacker may access sensitive data beyond their authorization level, leading to information disclosure. There is no indication of denial of service or system availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published by Elastic at this time. Users should monitor Elastic's advisories for updates and consider restricting access to Kibana Security Solution features to trusted users until a fix is available.