Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification

Weakness-Klassen (CWE)

• CWE-863Class

  Incorrect Authorization

  The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

  cwe.mitre.org →

Re-Analyse & Statuswechsel

Chronologie der NVD-Audit-Events für diese CVE — Reanalyses, CVSS-Updates, CPE-Diffs.

1. New CVE Received2026-09-03 19:17 UTC· security@elastic.co
   • Description: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).
   • CVSS V3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
   • CWE: CWE-863
   • Affected: New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/82xxx/CVE-2026-82302.json">CVE-2026-82302</a>
2. CVE Modified2026-09-03 19:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
   • SSVC: {"id":"CVE-2026-82302","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalI…

Betroffene Produkte

Aus der Hersteller-/CERT-Meldung extrahierte Produkte und Versionsbereiche. Ein Version-Range wie „<4.14.6“ impliziert die Update-Empfehlung „auf 4.14.6 oder höher aktualisieren“.

• bitnami

  kibana8.0.0

• bitnami

  kibana9.0.0

• bitnami

  kibana9.5.0

Quellen & Referenzen

• https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-3-security-update-esa-2026-178/390164
• https://nvd.nist.gov/vuln/detail/CVE-2026-82302
  web