CVE-2026-63259: Elastic Kibana

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the requester is not authorized to access.

Affected products

• Elastic Kibana: from 9.4.0, before 9.4.4 (fixed in 9.4.4)

Published 2026-07-21. Last modified 2026-08-03.