The vulnerability lies in Kibana’s Machine Learning feature that allows a user to remove a saved object from a space. When the target is a trained model, the system only checks privileges for creating anomaly detection jobs or data frame analytics jobs and ignores the specific privilege required for trained models. Consequently, a user who can create jobs but does not have the trained model privilege can remove the model from a space. The model itself is not deleted; it remains available in other spaces, and the change can be undone by an appropriately privileged user. The impact is therefore an unauthorized modification of model assignments within Kibana, potentially causing confusion or incorrect model usage but no direct data loss. This is a CWE‑862 Missing Authorization vulnerability.

The affected product is Elastic’s Kibana. Vulnerable releases include Kibana 8.19.20 and 9.4.5, the versions referenced in the security update ESA‑2026‑88. All earlier versions that did not apply the fix and which permit removal of trained models in this manner are also affected.

The CVSS score of 4.3 indicates a moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to possess privileges to create anomaly detection or data frame analytics jobs, which suggests the threat is primarily from privileged internal users or compromised accounts with those permissions. The attack can be performed via Kibana’s user interface or API without additional exploitation steps. Given the moderate severity and internal nature of the attack vector, the risk is considered medium to high for environments where roles are not tightly scoped.