The vulnerability is an incorrect authorization flaw in Kibana Fleet that allows a user with Fleet agent management privileges in one space to read policy details from other spaces. By accessing an internal enrollment endpoint that bypasses space-scoped controls, an attacker can obtain operational identifiers, policy names, management state, and infrastructure linkage information for spaces to which the user is not normally authorized. This flaw is a classic instance of CWE‑863 – Incorrect Authorization.

The issue affects the Elastic Kibana product. Specific versions are not listed in the advisory, so all versions that implement the Fleet enrollment endpoint could potentially be susceptible. Users should verify whether their Kibana deployment matches the affected architecture and review the related Elastic security update notice for precise version details.

The CVSS score is 4.3, indicating moderate severity. The EPSS score is not available, and the vulnerability is not cataloged by CISA in the KEV list. Exploitation requires a user with Fleet agent management privileges, so an attacker must first obtain or compromise a privileged account. Once they have that capability, they can directly query the internal endpoint to leak policy data across spaces. Because the data revealed is limited to policy and infrastructure metadata, the impact is mainly confidentiality loss for organizational operational details, but it does not enable direct code execution or system compromise.