Threats Tagged 'bit-elk-2026-72669'

Kibana contains a vulnerability where the Observability Onboarding flow state is not properly bound to the user who created it. Authenticated users with generic read access can view and modify onboarding flows of other users, potentially causing information disclosure and data tampering. Tampering with a flow may also cause server errors in the owner's onboarding view. This issue affects specific Kibana versions and has a high severity rating. A patch is available to address this vulnerability.

The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flows of other users, read their onboarding state, and write arbitrary progress data into them. A tampered flow can also cause the owner's onboarding view to fail with a server error.