Kibana 9.0.x < 9.0.6 / 9.1.x < 9.1.3 Incorrect Authorization (ESA-2025-13)

The version of Kibana running on the remote host is prior to 9.0 prior to 9.0.6 or 9.1 prior to 9.1.3. It is, therefore, a vulnerability as referenced in the ESA-2025-13 advisory. - Incorrect authorization in Kibana can lead to privilege escalation via the built-in reportinguser role which...

CVE-2025-25010 Kibana privilege escalation via reporting_user role

Incorrect authorization in Kibana can lead to privilege escalation via the built-in reportinguser role which incorrectly has the ability to access all Kibana Spaces...

CVE-2025-25010

Incorrect authorization in Kibana can lead to privilege escalation via the built-in reportinguser role which incorrectly has the ability to access all Kibana Spaces...

Kibana 9.0.6, 9.1.3 Security Update (ESA-2025-13)

Kibana privilege escalation viareportinguser role ESA-2025-13 Incorrect authorization in Kibana can lead to privilege escalation via the built-in reportinguser role which incorrectly has the ability to access all Kibana Spaces. Affected Versions: Kibana versions starting from and including 9.0.0,...

CVE-2017-8446: Insufficiently Protected Credentials

The Reporting feature in X-Pack in versions prior to 5.5.2 and standalone Reporting plugin versions versions prior to 2.4.6 had an impersonation vulnerability. A user with the reportinguser role could execute a report with the permissions of another reporting user, possibly gaining access to...