CVE-2026-63137: CWE-863 Incorrect Authorization in Elastic Kibana
Description
Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). A user holding workflow edit permissions could cause scheduled workflow executions to run with the privileges of a different, higher-privileged user, allowing access to and modification of data beyond their own authorization scope.
CVSS v3.1
Score 8.3high
Affected software
Elastic
Kibana
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CWE-863) in Kibana arises from incorrect access control configurations that permit privilege escalation. Specifically, a user who can edit workflows can manipulate scheduled executions to run under the context of a more privileged user, thereby gaining unauthorized access to data and capabilities. The issue affects Kibana version 9.3.0. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.
Potential Impact
An attacker with workflow edit permissions can escalate their privileges to those of a higher-privileged user, potentially accessing and modifying data beyond their authorized scope. This compromises confidentiality and integrity of data within Kibana, and may also impact availability to a limited extent.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict workflow edit permissions to trusted users only and monitor for suspicious activity related to workflow executions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- elastic
- Date Reserved
- 2026-07-15T18:23:57.166Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a972606acd9273b491915ba
Added to database: 09/01/2026, 19:22:46 UTC
Last enriched: 09/07/2026, 14:11:27 UTC
Last updated: 10/17/2026, 18:48:21 UTC
Views: 135
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.