Elk: Incorrect Authorization in Kibana Leading to Information Disclosure (CVE-2026-82299)

This vulnerability involves incorrect authorization in Kibana, specifically related to misconfigured access control security levels (CAPEC-180). An attacker with low privileges and network access could exploit this flaw to disclose sensitive information without impacting integrity or availability. The CVSS vector indicates no user interaction is required and the scope remains unchanged.

Successful exploitation could result in unauthorized disclosure of sensitive information from Kibana. There is no impact on data integrity or system availability. The vulnerability requires an attacker to have some level of privileges and network access to the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations in Kibana to ensure proper authorization levels are enforced.