The vulnerability allows an authenticated user with Machine Learning read access in one Kibana space to read audit and error messages from data frame analytics jobs in other spaces that the user is not authorized to access. This information leakage can reveal destination index names, analyzed field names, and failure details, compromising confidentiality. The weakness is classified as CWE‑639, an authorization bypass through user‑controlled keys.

Elastic Kibana is impacted. Users with Machine Learning read permissions in any Kibana space can inadvertently gain visibility into audit and error logs of jobs belonging to other spaces.

The CVSS score of 4.3 indicates a moderate impact. No EPSS value is available, and the vulnerability is not listed in CISA KEV. The likely attack vector is an authorized user that already has Machine Learning read access; no external attacker or privilege escalation is required. Exploitation requires the attacker to have legitimate access to Kibana, read permissions for Machine Learning, and the ability to target other spaces within the same deployment. The resulting impact is limited to confidential data leakage rather than full system compromise.