This vulnerability in Kibana arises from an incorrect authorization check (CWE-863) in a Machine Learning management endpoint. The endpoint validates only a broad privilege level but fails to verify that the user has permission to access the specific Machine Learning job or notification resource referenced in the request. Consequently, a low-privileged user with Machine Learning access in any Kibana space can exploit Kibana's internally elevated credentials to write to restricted Machine Learning system indices. This allows manipulation of audit and notification records for arbitrary jobs, including those in other spaces or owned by other users. No official patch or remediation level is indicated in the available data.

The vulnerability allows low-privileged users with Machine Learning access to modify audit and notification records of arbitrary Machine Learning jobs across different spaces and users. This compromises the integrity of these records but does not impact confidentiality or availability. There are no known exploits in the wild. The impact is limited to integrity loss of Machine Learning audit and notification data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Machine Learning access to trusted users only. Monitor for unusual modifications to Machine Learning audit and notification records. Follow Elastic's official advisories for updates on remediation.