Unrated severityNVD Advisory· Published Jul 21, 2026· Updated Jul 22, 2026

Missing Authorization in Kibana Leading to Information Disclosure

CVE-2026-63262

Description

Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control.

Affected products

Elastic/Kibanallm-fuzzy
osv-coords2 versions
pkg:bitnami/elk pkg:bitnami/kibana
>= 9.4.0, < 9.4.4+ 1 more
- (no CPE)range: >= 9.4.0, < 9.4.4
- (no CPE)range: >= 9.4.0, < 9.4.4

Patches

Vulnerability mechanics

References

discuss.elastic.co/t/kibana-9-4-4-security-update-esa-2026-73/388576mitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000