cwe-sdk-javascript

cwe-sdk Un SDK de Node.js para Common Weakness Enumeration CWE compatible con MITRE / CAPEC...

BIT-KIBANA-2026-82299 Incorrect Authorization in Kibana Leading to Information Disclosure

Incorrect Authorization CWE-863 in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180...

BIT-ELK-2026-82302 Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180...

CVE-2026-82299

Incorrect Authorization CWE-863 in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180...

CVE-2026-82299

CVE-2026-82299 is an Incorrect Authorization (CWE-863) vulnerability in Kibana that can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). The CVSS 3.1 score is 6.5 (MEDIUM) , with a network attack vector, low complexity, low privilege...

EUVD-2026-70662

Incorrect Authorization CWE-863 in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180...

CVE-2026-82298 Incorrect Authorization in Kibana Leading to Denial of Service

Incorrect Authorization CWE-863 in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180...

PT-2026-85215

Incorrect Authorization CWE-863 in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180...

CVE-2026-78599

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet write access could cause a subsequent administrative delete...

CVE-2026-78584 Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure

Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for Information CAPEC-54. An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are no...

CVE-2026-78591 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Kibana Leading to Unauthorized Resource Deletion

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal CAPEC-126. A low-privileged user could cause a subsequent action taken by a higher-privileged user in the Fleet...

EUVD-2026-70060

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet write access could cause a subsequent administrative delete...

CVE-2026-78605 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure

Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' CWE-444 in Elasticsearch can lead to information disclosure via HTTP Request Smuggling CAPEC-33. Under specific proxy deployment configurations, a network attacker could obtain confidential responses intended for other...

BIT-KIBANA-2026-72675 Missing Authorization in Kibana Machine Learning Leading to Cross-Space Information Disclosure and Unauthorized Data Modification

Missing Authorization CWE-862 in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse CAPEC-122. Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions and relies on a per-request space filter to...

BIT-KIBANA-2026-72673 Incorrect Authorization in Kibana Leading to Unauthorized Deletion of Synthetics Private Locations

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Synthetics private locations can be shared with more than one space, and deleting one removes it from every space it is...

BIT-KIBANA-2026-72667 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A specially crafted request submitted by an authenticated user with minimal privileges to a validation capability of the Observability log analysis feature...

BIT-KIBANA-2026-72665 Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions

Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A Kibana user who is able to author and evaluate Elastic Security detection rules can...

BIT-KIBANA-2026-72664 Missing Authorization in Kibana Leading to Unauthorized Execution of Endpoint Response Actions

Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A Kibana user who holds only detection rule authoring privileges for the Elastic Security solution c...

BIT-KIBANA-2026-72663 Inefficient Algorithmic Complexity in Kibana Leading to Denial of Service

Inefficient Algorithmic Complexity CWE-407 in Kibana can lead to denial of service via Input Data Manipulation CAPEC-153. A specially crafted, deeply nested expression submitted to a Kibana TSVB visualization is evaluated with a worst-case cost that grows disproportionately with the size of the...

BIT-KIBANA-2026-72661 Missing Authorization in Kibana Leading to Information Disclosure

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An internal Kibana data retrieval capability used by Elastic Defend endpoint response actions did not enforce the Security Solution and endpoint...