This vulnerability in Kibana is classified as CWE-441 (Unintended Proxy or Intermediary) and involves accessing functionality not properly constrained by access control lists (ACLs), corresponding to CAPEC-1. Under certain conditions, a lower-privileged user can leverage this flaw to have data from sources they are not authorized to access processed with the privileges of another user, potentially exposing sensitive information. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality impact without integrity or availability impact.

The impact is unauthorized information exposure due to improper access control enforcement, allowing a lower-privileged user to access data beyond their authorization by proxying requests through a higher-privileged context. There is no indication of integrity or availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict lower-privileged user access where possible and review access control configurations to minimize risk.