This vulnerability (CWE-862) in Elastic Kibana involves missing authorization checks that permit a Kibana user who can author and evaluate Elastic Security detection rules to perform response actions on enrolled agents without holding the necessary Osquery live query or Elastic Defend response action privileges. The flaw arises from functionality not properly constrained by access control lists (ACLs), allowing unauthorized execution of response actions. The impact includes potential disclosure of information from affected hosts or unauthorized modifications to their state. The affected versions explicitly include 8.5.0 and 9.0.0. No vendor advisory or patch information is provided, and the remediation level is unknown.

An attacker with the ability to author and evaluate detection rules in Kibana can bypass privilege restrictions to execute response actions on managed hosts. This can result in unauthorized disclosure of sensitive information or unauthorized changes to the state of those hosts. The vulnerability does not affect availability but has high confidentiality and integrity impacts as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or mitigation is available, restrict the ability to author and evaluate Elastic Security detection rules to trusted users only, as these privileges enable exploitation of this vulnerability.