This vulnerability (CWE-639) in Kibana arises from an inconsistency in the authorization logic for file access. Specifically, the access control check and the resource retrieval process use different mechanisms to resolve permissions, enabling a low-privileged authenticated user with limited file management permissions to bypass intended restrictions. As a result, such a user can retrieve, modify, or delete case attachments associated with features they should not have access to, such as Security Solution cases. The CVSS 3.1 score is 7.1, indicating a high severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. There is no vendor advisory or patch information provided, and the product is not a cloud service.

An attacker with low privileges can bypass authorization controls to access, modify, or delete protected case attachments in Kibana. This leads to unauthorized disclosure of sensitive information and compromises the integrity of case attachments, potentially affecting investigations or security operations relying on these cases. The vulnerability does not affect availability but impacts confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to Kibana to trusted users and monitor for suspicious activity related to case attachment management. Avoid granting unnecessary file management permissions to low-privileged users. Follow updates from Elastic for official fixes or temporary mitigations.