The flaw is a missing authorization check in Kibana’s server‑side Detection Rule Management that allows an authenticated attacker with rule‑management privileges to configure endpoint‑response actions such as host isolation, process termination, or suspension. This unauthorized configuration can compromise host integrity or cause denial of service by altering endpoint behavior.

Elastic Kibana is affected. All Kibana installations lacking the latest security update are vulnerable, with specific references to releases 9.3.0 and earlier as indicated by the common product enumeration strings.

The vulnerability has a CVSS score of 6.5, indicating moderate severity, and an EPSS score of less than 1%, suggesting a low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. Because exploitation requires an authenticated user with rule‑management privileges, the risk is limited to environments where such privileges are not tightly controlled; nevertheless, the potential to alter endpoint controls warrants prompt attention.