CVE-2026-63145

Name of the Vulnerable Software and Affected Versions Kibana (affected versions not specified)

Description An incorrect authorization issue exists in the Machine Learning functionality. A management endpoint performs an insufficient authorization check by validating only a coarse privilege level without verifying if the requesting user has access to the specific Machine Learning job or notification resources. This allows a low-privileged user with Machine Learning access in any space to manipulate audit and notification records for arbitrary jobs, including those in other spaces or belonging to other users. This is achieved by leveraging internally elevated credentials to write to restricted Machine Learning system indices that are otherwise inaccessible to the user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.