CVE-2026-63259CWE-639

CVE-2026-63259

Medium · published July 22, 2026

CVSS v3.1

4.3

EPSS

Percentile

20.1

In the wild

Unconfirmed

What it is

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the requester is not authorized to access.

The record

Technical detail

CVSS v3.1: 4.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00287 · 20.1th percentile
Weakness: CWE-639 · Authorization Bypass Through User-Controlled Key
Published: 2026-07-22T03:18Z

Affected products (1)

Product	Versions	Fixed in
elastic/kibana	≥ 9.4.0, < 9.4.4	9.4.4

References (1)

https://discuss.elastic.co/t/kibana-9-4-4-security-update-esa-2026-70/388573 · [email protected]

EPSS history

Timeline

21 JUL 22:37Z
Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure
cvelistv5