Description
Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which incorrectly has the ability to access all Kibana Spaces.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Elastic | Kibana | 9.0.0 – ≤ 9.0.5, 9.1.0 – ≤ 9.1.2 | — |
Advisories 1
- WID-SEC-2025-1923 Kibana: Schwachstelle ermöglicht Umgehen von Sicherheitsmechanismen BSI CERT-Bund (WID) · Aug 28, 2025