CVE-2025-25010: Elastic Kibana

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which incorrectly has the ability to access all Kibana Spaces.

Affected products

• Elastic Kibana: from 9.0.0, before 9.0.6 (fixed in 9.0.6); from 9.1.0, before 9.1.3 (fixed in 9.1.3)

Published 2025-08-28. Last modified 2026-06-17.