# CVE-2026-33462: Path Traversal in Kibana Leading to Unauthorized Deletion of User Accounts

> CVE-2026-33462: Path Traversal in Kibana Leading to Unauthorized Deletion of User Accounts. CVSS 4.6 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-33462
Last updated: 2026-10-14T20:10:00Z

- Published: 2026-05-28 19:33 UTC · Updated: 2026-10-14 20:10 UTC · Assigner: elastic
- CVSS: 4.6 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
- EPSS: 0.24%, 14th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-22

## Description

A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identifier. When an administrator subsequently attempts to delete this dashboard through the Kibana interface, the deletion request is redirected to an unintended internal endpoint, potentially resulting in the unauthorized deletion of user accounts or other resources. Exploitation requires an administrator to perform a delete action on the maliciously crafted dashboard object.

## Affected vendors and products

- Elastic: Kibana

## Tracked companies

- [Elastic Cloud](https://rewindex.com/company/elastic-cloud.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-33462)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-33462)
- [https://discuss.elastic.co/t/kibana-8-19-16-and-9-3-5-security-update-esa-2026-30/386545](https://discuss.elastic.co/t/kibana-8-19-16-and-9-3-5-security-update-esa-2026-30/386545)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-33462 · Markdown: https://rewindex.com/cve/CVE-2026-33462.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-33462 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:14:45.875Z