CVE-2026-63262: Elastic Kibana

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control.

Affected products

• Elastic Kibana: from 9.4.0, before 9.4.4 (fixed in 9.4.4)

Published 2026-07-22. Last modified 2026-08-03.