What is GHSA-wrjj-v99g-x4f7?

GHSA-wrjj-v99g-x4f7 is a security advisory published by GitHub Security Advisories with Medium severity. Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via...

Which CVE IDs does GHSA-wrjj-v99g-x4f7 cover?

GHSA-wrjj-v99g-x4f7 covers the following CVE IDs: CVE-2026-63143. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wrjj-v99g-x4f7?

GHSA-wrjj-v99g-x4f7 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-wrjj-v99g-x4f7MediumCVSS 4.3

Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via...

Vendor

GitHub Security Advisories

Published

July 22, 2026

Last Modified

July 22, 2026

🔗 CVE IDs covered (1)

CVE-2026-63143 →

📋 Description

Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The accessible data may include sensitive information returned by workflow steps, such as results from connected data sources that the caller would not otherwise be authorized to access.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-63143
https://discuss.elastic.co/t/kibana-9-3-8-9-4-4-security-update-esa-2026-67/388569
https://github.com/advisories/GHSA-wrjj-v99g-x4f7