The vulnerability arises from the Kibana machine learning feature executing operations with the internal service identity instead of the requesting user’s identity, even for users that possess only read access to the feature. This misuse of privilege allows the user to retrieve data from Elasticsearch indices that they would otherwise be unable to read, resulting in unauthorized disclosure of information. The weakness is categorized as CWE-250 (Execution with Unnecessary Privileges).

Elastic Kibana is the impacted product. No specific version information is listed in the CVE record, so all released builds prior to a future fix should be considered potentially vulnerable.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an internal user with read‑only machine‑learning permissions who can trigger the privileged operation; no additional Elasticsearch cluster or index privileges are required. If exploited, the attacker can gain unauthorized access to protected data without further permissions.