Missing Authorization in Kibana Leading to Information Disclosure

Description

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Experience feature did not enforce a Kibana-level authorization check that an equivalent, related API in the same feature did enforce. As a result, a user who held only data-store-level read access to an index, but no corresponding Kibana feature privilege, could retrieve index-derived metric data through Kibana that the properly-authorized API would otherwise have blocked.

Scores

EPSS (exploitation in 30 days)

0.21% · top 88% of all CVEs (5 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.

Weakness

• CWE-862 Missing Authorization (opens in a new tab)All about CWE-862 and its CVEs

Affected products

• Elastic · Kibana

  • affected 9.2.0 – ≤ 9.3.8

References (1)

• https://discuss.elastic.co/t/kibana-9-4-0-security-update-esa-2026-191/390864 (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-102410](https://trackcve.app/badge/CVE-2026-102410.svg)](https://trackcve.app/cve/CVE-2026-102410)

Record last updated 6 Oct 2026, 19:55 UTC.