CVE-2026-82302: CWE-863 Incorrect Authorization in Elastic Kibana

This vulnerability in Elastic Kibana is classified as CWE-863 (Incorrect Authorization). It enables unauthorized configuration modification by exploiting incorrectly configured access control security levels (CAPEC-180). The CVSS 3.1 base score is 8.1, indicating high severity, with network attack vector, low attack complexity, requiring low privileges but no user interaction, and impacts confidentiality and integrity with high impact but no availability impact. Affected versions explicitly include 8.0.0, 9.0.0, and 9.5.0. The vendor has not yet provided an official fix or remediation guidance.

Successful exploitation could allow an attacker with limited privileges to modify Kibana configuration settings without proper authorization, potentially leading to unauthorized access or changes in the system's behavior. The confidentiality and integrity of the system are highly impacted, but availability is not affected. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to Kibana interfaces to trusted users only and review access control configurations carefully to minimize risk.