Threats Tagged 'cve-2026-56147'

CVE-2026-56147 is an authorization bypass vulnerability in Kibana caused by inconsistent file access authorization logic. It allows low-privileged authenticated users to access, modify, or delete case attachments from feature areas they are not authorized to use. This flaw affects the integrity and confidentiality of case attachments, such as those related to Security Solution cases. The vulnerability arises because the access control check and resource retrieval use different resolution mechanisms, enabling privilege abuse.

CVE-2026-56147 is an authorization bypass vulnerability in Elastic Kibana that allows a low-privileged authenticated user to access, modify, or delete case attachments outside their authorized feature areas. This occurs due to inconsistent file access authorization logic, where access control checks and resource retrieval use different resolution methods. The vulnerability can lead to unauthorized information disclosure and compromise of case attachment integrity.