CVE-2026-72666

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no access to, via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A user who is authoriz...

Duplicate Advisory: SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gcwr-5mrf-fvch. This link is maintained to preserve external references. Original Description SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement that allows...

GHSA-MF42-3C8Q-X7X8 Duplicate Advisory: SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gcwr-5mrf-fvch. This link is maintained to preserve external references. Original Description SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement that allows...

CVE-2026-63754

SurrealDB before 3.1.0 is affected. A denial-of-service arises when malicious LIVE queries with WHERE clauses that evaluate to errors cause all CREATE, UPDATE, and DELETE operations on the watched table to fail. An authenticated user with only SELECT permission can block writes for any user (incl...

EUVD-2026-45925

SurrealDB versions before 3.1.0 contain a denial of service vulnerability where malicious LIVE queries with WHERE clauses that evaluate to errors cause all CREATE, UPDATE, and DELETE operations on the watched table to fail. An authenticated user with only select permission can prevent write...

CVE-2026-63754

SurrealDB versions before 3.1.0 contain a denial of service vulnerability where malicious LIVE queries with WHERE clauses that evaluate to errors cause all CREATE, UPDATE, and DELETE operations on the watched table to fail. An authenticated user with only select permission can prevent write...

CVE-2026-63754 SurrealDB before 3.1.0 Denial of Service via LIVE Query

SurrealDB versions before 3.1.0 contain a denial of service vulnerability where malicious LIVE queries with WHERE clauses that evaluate to errors cause all CREATE, UPDATE, and DELETE operations on the watched table to fail. An authenticated user with only select permission can prevent write...

CVE-2026-63754 SurrealDB before 3.1.0 Denial of Service via LIVE Query

SurrealDB versions before 3.1.0 contain a denial of service vulnerability where malicious LIVE queries with WHERE clauses that evaluate to errors cause all CREATE, UPDATE, and DELETE operations on the watched table to fail. An authenticated user with only select permission can prevent write...

CVE-2026-63754

SurrealDB versions before 3.1.0 contain a denial of service vulnerability where malicious LIVE queries with WHERE clauses that evaluate to errors cause all CREATE, UPDATE, and DELETE operations on the watched table to fail. An authenticated user with only select permission can prevent write...

CVE-2026-63754: Improper Check for Unusual or Exceptional Conditions

SurrealDB versions before 3.1.0 contain a denial of service vulnerability where malicious LIVE queries with WHERE clauses that evaluate to errors cause all CREATE, UPDATE, and DELETE operations on the watched table to fail. An authenticated user with only select permission can prevent write...

SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries

The KILL statement is used to terminate LIVE SELECT subscriptions that capture real-time changes to data within a table. The KILL statement implementation in core/src/expr/statements/kill.rs verifies that the requesting user has database-level access, but does not verify that the requesting user ...

BIT-KIBANA-2025-68422 Kibana Improper Authorization

Improper Authorization CWE-285 in Kibana can lead to privilege escalation CAPEC-233 by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This allows an attacker who lacks the live queries - read permission to successfully retrieve the list of li...

BIT-ELK-2025-68422 Kibana Improper Authorization

Improper Authorization CWE-285 in Kibana can lead to privilege escalation CAPEC-233 by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This allows an attacker who lacks the live queries - read permission to successfully retrieve the list of li...

CVE-2025-68422

A flaw was found in Kibana. An authenticated user can exploit this vulnerability by sending a specially crafted HTTP request, which bypasses intended permission restrictions. This improper authorization allows an attacker, who lacks the "live queries - read" permission, to successfully retrieve t...

EUVD-2025-204405

Improper Authorization CWE-285 in Kibana can lead to privilege escalation CAPEC-233 by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This allows an attacker who lacks the live queries - read permission to successfully retrieve the list of li...

Incorrect Authorization

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Incorrect Authorization in the live queries. An attacker can access unauthorized data by sending a crafted HTTP request. Remediati...

CVE-2025-68422

Improper Authorization CWE-285 in Kibana can lead to privilege escalation CAPEC-233 by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This allows an attacker who lacks the live queries - read permission to successfully retrieve the list of li...

CVE-2025-68422

Improper Authorization CWE-285 in Kibana can lead to privilege escalation CAPEC-233 by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This allows an attacker who lacks the live queries - read permission to successfully retrieve the list of li...

CVE-2025-68422 Kibana Improper Authorization

Improper Authorization CWE-285 in Kibana can lead to privilege escalation CAPEC-233 by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This allows an attacker who lacks the live queries - read permission to successfully retrieve the list of li...

CVE-2025-68422

CVE-2025-68422 describes an Improper Authorization (CWE-285) vulnerability in Kibana where an authenticated user lacking the live queries - read permission can bypass permission restrictions via a crafted HTTP request to retrieve the list of live queries. The issue could lead to information discl...