Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an internal API endpoint to retrieve sensitive configuration data, including private keys and authentication tokens, that should only be accessible to users with higher-level settings privileges. The endpoint composes its response by fetching full configuration objects and returning them directly, bypassing the authorization checks enforced by the dedicated settings APIs.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-08 | 2 | Disclosure1General1 |
| 2026-04-13 | 1 | General1 |
⚠️ Vulnerabilidades en productos Elastic ❗ CVE-2026-4498 ❗ CVE-2026-33466 ❗ CVE-2026-33461 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-elastic-2/ https://t.co/9mpmyikW4w
Post summary
The tweet announces three Elastic product vulnerabilities and links to external documentation, but offers no exploitation, mitigation, or technical details.
CVE-2026-33461 Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an in… https://www.cve.org/CVERecord?id=CVE-2026-33461
Post summary
The post provides a brief description of CVE-2026-33461 as an incorrect authorization issue in Kibana that could lead to information disclosure, but offers no details on exploits, active use, or available patches.
CVE-2026-33461 Privilege Abuse Information Disclosure in Kibana Fleet API Authorization https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33461
Post summary
The provided text only references CVE‑2026‑33461 via a link, without additional content on PoC, exploitation, patches, or technical details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | elastic | kibana | - | - | - |