This vulnerability in Kibana 9.4.0 involves an authorization bypass via user-controlled keys. Specifically, an attacker can supply identifiers that reference scheduled query result data belonging to Kibana Spaces they should not have access to, potentially leading to unauthorized information disclosure. The issue is categorized as CWE-639 (Authorization Bypass Through User-Controlled Key). No official patch or remediation level has been provided by the vendor at this time.

The impact is limited to unauthorized disclosure of information from scheduled query results in Kibana Spaces that the attacker is not authorized to access. There is no indication of integrity or availability impact. The CVSS vector indicates network attack vector, low attack complexity, requiring low privileges, no user interaction, and only confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Elastic's advisories for updates. Until a fix is available, restrict access to Kibana and scheduled query data to trusted users only and review access controls carefully to minimize exposure.