Executive brief
A vulnerability in Kibana's Machine Learning feature allows users with low-level access to modify audit logs and notification records they should not be able to reach. This could allow an internal user to hide their activities or tamper with the history of automated analysis jobs across different business units or 'spaces.' While it does not expose private data, it compromises the integrity of system logs used for monitoring and compliance.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in Kibana's Machine Learning management endpoints. The affected endpoints perform coarse privilege checks but fail to validate if the requesting user has specific access to the Machine Learning job or notification resources identified in the request. By exploiting this, a low-privileged user with basic ML access can leverage Kibana's internally elevated credentials to write to restricted system indices. This allows the manipulation of audit and notification records for arbitrary jobs, including those in other Kibana spaces. The issue is resolved in Kibana versions 8.19.19, 9.3.8, and 9.4.4.
Affected products
- Elastic Kibana 8.0.0 to 8.19.18, 9.0.0 to 9.3.7, 9.4.0 to 9.4.3
Timeline
- 2026-07-21: disclosed
- 2026-07-21: advisory
- 2026-07-21: patched