This vulnerability (CWE-862) in Elastic Kibana arises from missing authorization controls that improperly allow users with detection rule authoring privileges to associate automated endpoint response actions with detection rules. These users can trigger response actions on managed hosts despite lacking the dedicated privileges for endpoint response actions (e.g., host isolation, process operations). When alerts are generated by such rules, the unauthorized response actions are executed against the targeted hosts. The issue affects Kibana versions 8.9.0 and 9.0.0. No official patch or remediation level has been published by Elastic as of the data provided.

An attacker or user with detection rule authoring privileges can cause automated response actions to be executed on managed hosts without proper authorization. This could lead to unauthorized interference with endpoint operations such as isolating hosts or manipulating processes, potentially disrupting normal operations or causing unintended consequences. There is no indication of confidentiality or availability impact, but integrity is impacted due to unauthorized execution of actions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict detection rule authoring privileges to trusted users only and monitor rule configurations closely to prevent unauthorized association of response actions. Follow Elastic's official advisories for updates on remediation.