This vulnerability is a missing authorization flaw in Kibana's machine learning component. Because the component removes the per-request space filter on a subset of operations, an attacker can issue requests from one space that are executed against the data of every space in the deployment. The result is that sensitive machine‑learning data can be read or altered by users who should be restricted to their own space. Confidentiality is compromised through cross‑space data disclosure, and integrity is threatened by the potential for unauthorized data modification. The weakness is identified as CWE‑862.

Elastic's Kibana product is affected. Any deployment of Kibana that includes the machine‑learning feature is potentially vulnerable, although the input does not list specific vulnerable versions. System owners should verify whether their Kibana installation contains the affected code paths and should elevate permissions for machine‑learning requests only to the necessary spaces.

The CVSS v3.1 score is 7.1, indicating a high severity. EPSS is not reported, and the vulnerability is not listed in the CISA KEV catalog. The most realistic attack scenario requires an authenticated user with the ability to issue machine‑learning API calls; the attacker then benefits from the missing space‑scoping filter. An attacker with any such privileges can read or modify machine‑learning data across all spaces. Because the flaw is a lack of authorization rather than a privilege escalation, the exploitation does not require administrative credentials. Consequently, there is a tangible risk to deployments where broad‑access users misuse the API.