Elastic Kibana’s Fleet feature contains an incorrect authorization check that allows users with limited Fleet privileges to call an internal API endpoint and retrieve full configuration objects. The response includes private keys and authentication tokens that should only be accessible to users with higher‑level settings privileges, thereby exposing critical credentials.

The vulnerability impacts Elastic Kibana installations that provide Fleet functionality. No specific version numbers are listed in the CVE data, so any deployment of Kibana with Fleet enabled could be at risk until an official patch is applied.

The CVSS score of 7.7 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers who are authenticated with limited Fleet rights can exploit an internal API call that bypasses the proper authorization checks. This can lead to the disclosure of sensitive configuration data, potentially compromising credentials and enabling further exploitation of the underlying infrastructure. The likely attack vector is an internal API accessed by an authenticated user, as inferred from the description.