CVE details
CVE-2026-63137
Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). A user holding workflow edit permissions could cause scheduled workflow executions to run with the privileges of a different, higher-privileged user, allowing access to and modification of data beyond their own authorization scope.
- Score
- 8.3 high
- Published
- 2026-09-01
- Links
- NVD · cve.org · Report wrong data
Matched ports (2)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| textproc/kibana93 | kibana93 | 9.3.8 | possibly backported | elastic@FreeBSD.org |
| textproc/kibana94 | kibana94 | 9.4.7 | fixed by update | elastic@FreeBSD.org |