A logic error in Kibana’s handling of token expiration timestamps allows a time‑bounded access token to stay valid past its intended window. This flaw enables an unauthenticated actor who obtains such a token to retrieve protected content after the token has expired, leading to information disclosure and unauthorized file access.

Elastic Kibana is affected. Version details are not supplied by the CNA. All deployments using Kibana should be reviewed for the presence of expired or time‑bounded tokens.

The CVSS score of 5.3 indicates a moderate severity vulnerability. EPSS data is unavailable, and the vulnerability is not listed in CISA KEV. An attacker must first acquire a valid token; the flaw permits reuse of that token after its expiration. Because the attack requires possession of a token, the likelihood of exploitation depends on token exposure, but once a token is compromised the attacker can read protected files until the token is revoked.