This vulnerability (CWE-915) in Elastic Kibana affects the case management functionality of Elastic Security. The root cause is improper control over modification of dynamically-determined object attributes via the case management API. Specifically, the API does not enforce authorization checks consistently, allowing authenticated users with limited privileges to manipulate user-controlled variables and modify case data they are not authorized to edit. The vulnerability affects Kibana versions 8.0.0 and 9.0.0. No official patch or remediation level has been published yet, and there are no known exploits in the wild.

An authenticated user with low privileges can modify case data they are only entitled to view, potentially leading to unauthorized data alteration within the case management system. There is no impact on confidentiality or availability reported, but the integrity of case data can be compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the case management API to trusted users only and monitor for unusual modification activities. Avoid granting unnecessary privileges to users who do not require case editing capabilities.