Vulnerabilities

CVSS

4.3 Medium

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Risk score

34.4

Published

2026-07-21

Status

Analyzed

Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, a lower-privileged user can cause data from sources they are not authorized to access to be processed using another user's privileges.

Weaknesses

CWE-863

Coverage 1

threat-intel

Multiples vulnérabilités dans les produits Elastic (22 juillet 2026)

Multiple vulnerabilities have been discovered in Elastic products, including Elasticsearch and Kibana. These vulnerabilities can lead to data integrity compromise, data confidentiality breaches, and denial-of-service att…

CERT-FR · Jul 22, 2026 High

CVE-2018-17245CVE-2026-42397CVE-2026-49092vulnerabilityssrfelastic

All articles mentioning it

Advisories and references

• discuss.elastic.co/t/kibana-9-4-3-security-update-esa-2026-54/388553