This vulnerability (CWE-639) in Kibana arises from an inconsistency in the file access authorization logic. Specifically, the access control check and the resource retrieval mechanisms differ, enabling an authenticated user with limited file management permissions to bypass intended restrictions. As a result, such a user can retrieve, modify, or delete case attachments associated with features they lack privileges for, such as Security Solution cases. The issue represents an authorization bypass through a user-controlled key, enabling privilege abuse (CAPEC-122).

An attacker with low-level authenticated access can gain unauthorized access to sensitive case attachments, potentially leading to information disclosure and integrity compromise of those attachments. This can affect the confidentiality and integrity of case data within Kibana, particularly impacting protected feature areas like Security Solution cases. The CVSS score of 7.1 reflects a high severity with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict access to Kibana to trusted users only and monitor for suspicious activity related to case attachment access. Follow updates from Elastic for any forthcoming patches or official mitigations.