The vulnerability arises because the state stored for the Observability Onboarding flow in Kibana is not bound to the user who created it. The API routes that read and update this state do not verify ownership, enabling any authenticated user with generic read access to the space to discover onboarding flows of other users, read their onboarding state, and write arbitrary progress data. Tampering with these flows can also cause the original owner's onboarding view to fail with a server error. This issue is tracked as CWE-862 (Missing Authorization).

An attacker with authenticated access and generic read permissions can access and modify onboarding flow states belonging to other users. This unauthorized access can lead to information disclosure (confidentiality impact), unauthorized modification of onboarding progress data (integrity impact), and denial of service to the legitimate user by causing server errors in their onboarding view (availability impact). The CVSS score of 7.6 reflects a high severity with network attack vector, low attack complexity, and no user interaction required.

No official fix or patch is currently available for this vulnerability. Since the vendor advisory does not provide remediation guidance or indicate a temporary fix, users should monitor the Elastic vendor advisories for updates. Until a patch is released, restrict authenticated user permissions to the minimum necessary and consider limiting access to the Observability Onboarding feature to trusted users only.