CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2026-63143

Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The accessible data may include sensitive information returned by workflow steps, such as results from connected data sources that the caller would not otherwise be authorized to access.

Score
4.3 medium
Published
2026-07-21
Links
NVD · cve.org · Report wrong data

Matched ports (2)

PortPackageVersionStatusMaintainer
textproc/kibana91kibana919.1.10unaddressedelastic@FreeBSD.org
textproc/kibana92kibana929.2.8unaddressedelastic@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>kibana91</name>
	<range><lt>9.3.8</lt></range>
      </package>
      <package>
	<name>kibana92</name>
	<range><lt>9.3.8</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Missing Authorization (CWE-862) in Kibana can lead to unauthorized
	information disclosure via Privilege Abuse (CAPEC-122). A user with
	limited feature privileges can access workflow execution outputs in
	their Kibana space without the authorization required to do so through
	the documented API. The accessible data may include sensitive
	information returned by workflow steps, such as results from connected
	data sources that the caller would not otherwise be authorized to
	access.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-63143</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-63143</url>
    </references>
    <dates>
      <discovery>2026-07-21</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>