This vulnerability arises from an insufficient authorization check in Kibana’s Machine Learning management endpoint. The endpoint only confirms a coarse privilege level and fails to verify that the caller has access to the specific Machine Learning job or notification resources referenced in the request. Consequently, a low-privileged user who has general Machine Learning access across any Kibana space can modify audit and notification entries for jobs that belong to other erase, alter, or fabricate audit trails, thereby breaking the integrity of the system’s forensic records. The weakness is a classic example of CWE-863, Incorrect Authorization.

The affected product is Elastic Kibana, particularly the Machine Learning component. No specific version range is supplied in the advisory, so any Kibana release that includes Machine Learning functionality until the issue is patched may be vulnerable.

The CVSS score of 4.3 indicates a low impact when viewed in isolation, and the EPSS score of <1% suggests that exploitation is unlikely in the current landscape. The issue is not listed in CISA’s KEV catalog. The likely attack vector involves sending a crafted request to the Machine Learning endpoint via the Kibana UI or API; the attacker only needs the ability to log into Kibana with basic Machine Learning privileges. Once authenticated, the attacker can supply arbitrary job identifiers to manipulate audit logs for jobs they normally cannot reach. This attack does not require additional privilege escalation beyond the initial Kibana login, making it relatively easy for a disgruntled or compromised low-privileged account to compromise audit integrity.