Medium severity6.5NVD Advisory· Published Sep 3, 2026· Updated Sep 8, 2026

CVE-2026-82299

Description

Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Elastic/Kibanallm-fuzzy
osv-coords2 versions
pkg:bitnami/elk pkg:bitnami/kibana
>= 9.0.0, < 9.4.6+ 1 more
- (no CPE)range: >= 9.0.0, < 9.4.6
- (no CPE)range: >= 9.0.0, < 9.4.6

Patches

Vulnerability mechanics

References

discuss.elastic.co/t/kibana-9-4-6-9-5-3-security-update-esa-2026-175/390163nvd

News mentions

Elastic Kibana: 25 Authorization and Resource Management Vulnerabilities Disclosed Together
Vypr Intelligence · Sep 3, 2026

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000