CVE-2026-63145

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>kibana91</name>
	<range><lt>8.19.19</lt></range>
      </package>
      <package>
	<name>kibana92</name>
	<range><lt>8.19.19</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Incorrect Authorization (CWE-863) in Kibana can lead to integrity
	compromise of Machine Learning audit and notification records via
	Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1).

A
	vulnerability exists in Kibana's Machine Learning functionality where
	a Machine Learning management endpoint performs an insufficient
	authorization check. The endpoint validates only a coarse privilege
	level but does not verify that the requesting user has access to the
	specific Machine Learning job or notification resources provided in
	the request. As a result, a low-privileged user with Machine Learning
	access in any Kibana space can manipulate Machine Learning audit and
	notification records for arbitrary jobs—including jobs in other
	spaces or belonging to other users—by leveraging Kibana's internally
	elevated credentials to write to restricted Machine Learning system
	indices that the user cannot access directly.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-63145</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-63145</url>
    </references>
    <dates>
      <discovery>2026-07-21</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>