This vulnerability (CWE-862) in Elastic Kibana involves missing authorization controls that permit a user able to author and evaluate Elastic Security detection rules to trigger Osquery live queries and Elastic Defend response actions on enrolled agents without having the required privileges. The flaw arises from functionality not properly constrained by ACLs, allowing unauthorized execution of response actions. The impact includes potential information disclosure and unauthorized state changes on managed hosts. The CVSS 3.1 base score is 8.1 (high severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high confidentiality and integrity impact but no availability impact. Affected versions explicitly include 8.5.0 and 9.0.0. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

An attacker with privileges to author and evaluate detection rules in Kibana can execute response actions on managed hosts without having the necessary Osquery live query or Elastic Defend response action privileges. This can lead to unauthorized disclosure of sensitive information or unauthorized modifications to the state of affected hosts. The vulnerability does not impact availability but has high confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the ability to author and evaluate Elastic Security detection rules to trusted users only. Monitor vendor communications for updates regarding patches or official mitigations.