Authorization Bypass Vulnerability in Kibana by Elastic

CVE-2026-56147

What is CVE-2026-56147?

An authorization bypass vulnerability in Kibana allows low-privileged users to improperly access, modify, or delete case attachments. This occurs due to an inconsistency in the file access authorization logic, enabling an attacker to retrieve sensitive information from areas they are not permitted to access without the necessary privileges. The flaw can lead to unauthorized information disclosure and compromise the integrity of case attachments associated with critical security features.

References