The vulnerability arises from improper authorization enforcement in the case management API of Elastic Security in Kibana. A user with an authenticated session but insufficient privileges can manipulate user‑controlled variables, causing the API to accept object attributes that were not subject to the same checks performed in the UI. This allows an attacker to modify case records they are only allowed to view, resulting in unauthorized data modification. The weakness is identified as CWE‑915.

Elastic Security in Kibana functions that include case management are affected. Versions prior to the security update referenced in the Elastic discussion thread lack the necessary authorization checks. The data does not enumerate specific version numbers, so any deployment using case management prior to the update should be considered at risk.

The CVSS score of 4.3 indicates a moderate severity. EPSS is not available and the vulnerability is not listed in CISA KEV, suggesting that no widespread exploitation has been reported. The attack requires authenticated access but does not need privileged API rights; a low‑privileged user can craft requests that exploit the missing attribute checks. Because the API accepts user‑controlled variables directly, the vulnerability can be exploited without interacting with the UI, implying a higher likelihood of abuse in environments where the API is exposed.