# CVE-2026-63143: Missing Authorization in Kibana Leading to Unauthorized Information Disclosure

> CVE-2026-63143: Missing Authorization in Kibana Leading to Unauthorized Information Disclosure. CVSS 4.3 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-63143
Last updated: 2026-10-24T17:10:00Z

- Published: 2026-07-21 22:09 UTC · Updated: 2026-10-24 17:10 UTC · Assigner: elastic
- CVSS: 4.3 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- EPSS: 0.33%, 26th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-862

## Description

Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The accessible data may include sensitive information returned by workflow steps, such as results from connected data sources that the caller would not otherwise be authorized to access.

## Affected vendors and products

- Elastic: Kibana

## Tracked companies

- [Elastic Cloud](https://rewindex.com/company/elastic-cloud.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-63143)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-63143)
- [https://discuss.elastic.co/t/kibana-9-3-8-9-4-4-security-update-esa-2026-67/388569](https://discuss.elastic.co/t/kibana-9-3-8-9-4-4-security-update-esa-2026-67/388569)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-63143 · Markdown: https://rewindex.com/cve/CVE-2026-63143.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-63143 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:15:40.682Z