Vulnerability · Published Sep 1, 2026 · Assigned by elastic

CVE-2026-63137Incorrect Authorization in Kibana Leading to Privilege Escalation

High 8.3

In plain English

A high-severity incorrect authorization in Kibana from Elastic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)8.3High

Exploit odds (30 days)0.5%top 57.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). A user holding workflow edit permissions could cause scheduled workflow executions to run with the privileges of a different, higher-privileged user, allowing access to and modification of data beyond their own authorization scope.

Affected products (as reported)

Vendor	Product	Versions
Elastic	Kibana	9.3.0 – through 9.4.2

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

References

https://discuss.elastic.co/t/kibana-9-4-3-security-update-esa-2026-61/390086