A missing authorization check in Kibana’s entity store configuration operation permits an authenticated user with elevated privileges to trigger a background task that reads from Elasticsearch indices for which the user has no read rights. The data extracted from those indices is then returned through the entity store output, leading to confidential data leakage. The vulnerability is classified as a moderate severity issue by CVSS 5.5, indicating a reasonably low but real risk of disclosure if the user has the appropriate privilege level.

The flaw exists in Elastic’s Kibana product. All deployments of Kibana that rely on the entity store feature, particularly versions released before the official security update, could be affected. Specific affected versions are not listed in the advisory, so the risk extends to any unpatched Kibana instance.

The CVSS score of 5.5 reflects moderate potential impact. The EPSS score is not provided, so the likelihood of exploitation in the wild cannot be quantified from the data. The issue is not listed in the CISA KEV catalog, indicating no confirmed active exploitation cases yet. An attacker must first authenticate to Kibana with a role that has elevated privileges that allow entity store configuration. Once authenticated, the attacker can induce the background task to read unauthorized indices and obtain the data, thus the attack vector requires legitimate user credentials but no additional system access.