{"id":"elastic-security-e93d4670503d","seq":2825,"kind":"advisory","title":"Kibana 8.19.22, 9.4.6 Security Update (ESA-2026-103)","url":"https://discuss.elastic.co/t/kibana-8-19-22-9-4-6-security-update-esa-2026-103/390679","permalink":"https://vulnpulse.app/items/elastic-security-e93d4670503d","summary":"Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user granted the Timeline feature privilege in a Kibana space could enumerate, read, modify, and delete draft Timeline objects belonging to other users in the same space. Read access is sufficient for enumeration and disclosure; the Timeli…","severity":null,"techs":["elasticsearch"],"cves":[],"tags":["security"],"source":{"id":"elastic-security","name":"Elastic Security Announcements"},"published_at":"2026-09-25T08:32:22.000Z","fetched_at":"2026-10-21T16:17:47.217Z"}