This vulnerability (CWE-862) in Elastic Kibana permits a user who only has detection rule authoring privileges within the Elastic Security solution to associate automated endpoint response actions with detection rules. These response actions include host isolation, process operations, and execute operations, which normally require dedicated endpoint response action privileges. Due to missing authorization checks, when such detection rules generate alerts, the unauthorized response actions are executed against matching hosts. The issue affects Kibana versions 8.9.0 and 9.0.0. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

An attacker with limited privileges (detection rule authoring) can cause unauthorized execution of potentially disruptive endpoint response actions on managed hosts. This could lead to unintended or malicious host isolation or process manipulation, impacting the integrity of managed systems. Confidentiality and availability impacts are not indicated, but integrity impact is high as per CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict detection rule authoring privileges to trusted users only and monitor rule configurations for unauthorized response actions. Avoid granting detection rule authoring privileges broadly.