Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels… (CVE-2026-63137)

CVE-2026-63137 describes an incorrect authorization flaw in Kibana where improperly configured access control security levels enable privilege escalation. Specifically, a user who has permission to edit workflows can manipulate scheduled workflow executions to run under the identity of a more privileged user. This vulnerability arises from insufficient enforcement of access control checks, allowing unauthorized privilege escalation and potential data compromise.

Successful exploitation allows a user with limited workflow edit permissions to gain higher privileges temporarily during scheduled workflow execution. This results in unauthorized access to and modification of data that the user would normally be restricted from accessing, potentially compromising confidentiality and integrity of the system's data. The CVSS score of 8.3 indicates a high severity with network attack vector, low attack complexity, and no user interaction required.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict workflow edit permissions to trusted users only and review access control configurations to minimize risk.