A path traversal flaw in Kibana’s dashboard management allows an authenticated user with limited permissions to create a dashboard that references an arbitrary internal endpoint. When an administrator later attempts to delete that dashboard, the request is redirected, enabling the attacker to delete user accounts or other protected resources. The weakness leads to integrity loss, potentially causing loss of user accounts and disruption of service. The flaw is a classic case of CWE‑22 path traversal.

Elastic Kibana systems where dashboard management is enabled are affected; the CVE data does not specify a particular major or minor release, indicating that any Kibana instance could be vulnerable until a patch is applied.

The CVSS score of 4.6 suggests moderate severity, and no EPSS score is available, so exploitation probability cannot be precisely quantified. The flaw requires an authenticated administrator to perform a delete action on the malicious dashboard, making exploitation less likely in environments with strict admin controls. The vulnerability is not listed in CISA KEV, and no public exploits are currently documented.