CVE-2026-56147

{
  "id": "CVE-2026-56147",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-21T21:16:52.433",
  "lastModified": "2026-10-24T19:10:00.127",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inconsistency in Kibana's file access authorization logic allows a low-privileged authenticated user to retrieve, modify, and delete case attachments that belong to feature areas they are not authorized to access. Because the access control check and the resource retrieval use different resolution mechanisms, an authenticated attacker with limited file management permissions can obtain the contents of, modify, or delete protected case attachments — such as those associated with Security Solution cases — without holding the privileges required to access those features."
    },
    {
      "lang": "es",
      "value": "Elusión de autorización mediante clave controlada por el usuario (CWE-639) en Kibana puede conducir a la revelación de información no autorizada y al compromiso de la integridad de los adjuntos de casos a través de Abuso de Privilegios (CAPEC-122). Una inconsistencia en la lógica de autorización de acceso a archivos de Kibana permite a un usuario autenticado con bajos privilegios recuperar, modificar y eliminar adjuntos de casos que pertenecen a áreas de características a las que no están autorizados a acceder. Debido a que la verificación de control de acceso y la recuperación de recursos utilizan diferentes mecanismos de resolución, un atacante autenticado con permisos limitados de gestión de archivos puede obtener el contenido de, modificar o eliminar adjuntos de casos protegidos - como los asociados con casos de Solución de Seguridad - sin poseer los privilegios requeridos para acceder a esas características."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Elastic",
          "product": "Kibana",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "9.0.0",
              "lessThanOrEqual": "9.3.6",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "9.4.0",
              "lessThanOrEqual": "9.4.2",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.7.0",
              "lessThanOrEqual": "8.19.17",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-22T19:31:47.326241Z",
          "id": "CVE-2026-56147",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "8.19.0",
              "versionEndExcluding": "8.19.18",
              "matchCriteriaId": "2A55F7E1-308B-4D90-A96D-D38C3B886D27"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "9.3.0",
              "versionEndExcluding": "9.3.7",
              "matchCriteriaId": "5C1050D2-186B-40DA-9E10-BC820987BD72"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "9.4.0",
              "versionEndExcluding": "9.4.3",
              "matchCriteriaId": "A54D142F-22A7-4324-933D-02DCDBF32A4E"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://discuss.elastic.co/t/kibana-8-19-18-9-3-7-9-4-3-security-update-esa-2026-59/388558",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}