CVE-2026-33463CWE-672

CVE-2026-33463

Medium · published May 29, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
31.8
In the wild
Unconfirmed
What it is

Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time-bounded access token to remain usable beyond its intended validity window, enabling an unauthenticated actor in possession of the token to retrieve the associated content after expiration.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00389 · 31.8th percentile
Weakness
CWE-672 · Operation on a Resource after Expiration or Release
Published
2026-05-29T00:16Z
Affected products (2)
ProductVersionsFixed in
elastic/kibana≥ 8.0.0, < 8.19.168.19.16
elastic/kibana≥ 9.0.0, < 9.3.59.3.5
References (1)
https://discuss.elastic.co/t/8-19-16-9-3-5-security-update-esa-2026-33/386551 · [email protected]
EPSS history
Timeline
  • 28 MAY 19:37Z
    Operation on a Resource after Expiration or Termination in Kibana Leading to Unauthorized File Access
    cvelistv5