CVE-2026-56147

Assessment

Why it matters

EPSS is 0.2%; technical severity is CVSS 7.1.

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inconsistency in Kibana's file access authorization logic allows a low-privileged authenticated user to retrieve, modify, and delete case attachments that belong to feature areas they are not authorized to access. Because the access control check and the resource retrieval use different resolution mechanisms, an authenticated attacker with limited file management permissions can obtain the contents of, modify, or delete protected case attachments — such as those associated with Security Solution cases — without holding the privileges required to access those features.

Who should care

• Teams operating Kibana
• Vulnerability and exposure management teams
• Security operations teams monitoring exploitation activity

Response plan

What I would do

1. Confirm whether Kibana is present in the environment.
2. Identify affected versions and establish whether vulnerable services are exposed or reachable.
3. Vendor advisory from discuss.elastic.co
4. Review relevant security telemetry for evidence of attempted or successful exploitation.
5. Document the remediation decision and track it to verified completion.

Technical details

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

CWE

CWE-639

Affected versions

Elastic Kibana (Start Including 8.19.0, End Excluding 8.19.18 | Start Including 9.3.0, End Excluding 9.3.7 | Start Including 9.4.0, End Excluding 9.4.3)

Fixed versions

Elastic Kibana (Fixed from 8.19.18, 9.3.7, 9.4.3)

Published

21 July 2026

Attack vector

Network

Privileges required

Low

User interaction

None

Signal timeline

1. 21 Jul 2026CVE published
2. 20 Aug 2026Latest EPSS score: 0.2%
3. 19 Aug 2026 · 13:54 UTCSignal calculated at 11

External references

• Discuss Elastic Co Technical reference 388558 ↗