Elk: Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification (CVE-2026-82302)

This vulnerability in Kibana arises from incorrect authorization controls (CWE-863), enabling unauthorized configuration modifications through exploitation of incorrectly configured access control security levels (CAPEC-180). The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates that an attacker with low privileges and no user interaction can remotely exploit this flaw to gain high confidentiality and integrity impact. No vendor advisory or patch information is currently available, and no affected versions are specified.

Successful exploitation can lead to unauthorized modification of Kibana configuration settings, compromising confidentiality and integrity of the system configuration. This could allow attackers to alter system behavior or gain further unauthorized access. Availability is not impacted according to the CVSS vector. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations in Kibana to ensure that only authorized users have permission to modify configuration settings.