Elastic Kibana Improper Authorization Vulnerability Allowing Privilege Escalation

A vulnerability exists in Elastic Kibana versions 7.x, 8.x (8.0.0 through 8.19.7), and 9.x (9.0.0 through 9.1.7 and 9.2.0 through 9.2.1) that involves improper authorization. This flaw allows an authenticated user to escalate privileges by changing a document's sharing type to 'global' without having the necessary permissions. As a result, the document becomes visible to everyone in the space through a crafted HTTP request.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation, allowing users to gain access to documents they should not be able to share or view.

Remediation

Users can upgrade to Kibana versions 8.19.8, 9.1.8, or 9.2.2 to address this vulnerability.