Kibana stores the state for Observability Onboarding flows without binding it to the user who created the flow, and the API endpoints that read and update that state do not verify ownership. As a result, an authenticated user with only generic read access to a space can view another user’s onboarding flows, read their state, and write arbitrary progress data into them. A tampered flow can also trigger a server error when the owner later accesses their onboarding view. The vulnerability therefore compromises confidentiality by exposing information that should be private to another user and integrity by allowing unauthorized modification of state data, potentially disrupting onboarding processes.

The affected product is Elastic Kibana. Versions prior to the security update listed in the Elastic discussion thread – specifically Kibana 8.19.19 and Kibana 9.4.5 – are vulnerable. The precise version range is not explicitly detailed in the CVE description, but the update notes indicate all releases before these patched versions are impacted.

The CVSS score of 7.6 classifies the vulnerability as high severity. EPSS information is not available, and the CVE is not listed in the CISA KEV catalog, suggesting that wide-scale exploitation has not been confirmed. The likely attack vector is via the Kibana web interface by an authenticated user with read permissions, meaning that any user who gains such access can exploit the flaw without needing elevated privileges. The impact is limited to the space to which the user has access, but within that space, disclosure and tampering of onboarding state can lead to significant operational disruptions.