Threats Tagged 'bit-elk-2026-72664'

A missing authorization vulnerability in Kibana allows users with detection rule authoring privileges to execute Elastic Defend endpoint response actions without having the necessary dedicated endpoint response action privileges. This flaw enables unauthorized execution of actions such as host isolation and process operations when detection rules trigger alerts. The issue affects Kibana versions from 8.9.0 up to but not including 8.19.20, and from 9.0.0 up to but not including 9.4.5. A patch is available to address this vulnerability.

Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A Kibana user who holds only detection rule authoring privileges for the Elastic Security solution can associate automated endpoint response actions with a detection rule, even though the dedicated Endpoint response action privileges that govern those capabilities (host isolation, process operations, and execute operations) have not been granted to that user. When such a rule generates alerts, the associated response actions are carried out against the matching hosts.