What is GHSA-crwj-8qw4-x525?

GHSA-crwj-8qw4-x525 is a security advisory published by GitHub Security Advisories with Medium severity. Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information...

Which CVE IDs does GHSA-crwj-8qw4-x525 cover?

GHSA-crwj-8qw4-x525 covers the following CVE IDs: CVE-2026-115295. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-crwj-8qw4-x525?

GHSA-crwj-8qw4-x525 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-crwj-8qw4-x525MediumCVSS 4.3

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information...

Vendor

GitHub Security Advisories

Published

November 3, 2026

Last Modified

November 3, 2026

🔗 CVE IDs covered (1)

CVE-2026-115295 →

📋 Description

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read access to connectors in one Kibana space can retrieve connector execution log information from other spaces that they are not authorized to access. The disclosed information includes connector names and identifiers, execution status, timestamps, error messages, and aggregated execution statistics.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-115295
https://discuss.elastic.co/t/kibana-8-19-24-9-4-9-9-5-6-security-update-esa-2026-206/391360
https://github.com/advisories/GHSA-crwj-8qw4-x525