CVE-2025-68386: 
Kibana vulnerability analysis and mitigation

CVE-2025-68386 is an Improper Authorization vulnerability (CWE-863) in Elastic Kibana that allows an authenticated user to escalate privileges by changing a document's sharing type to "global" without the required permissions, making it visible to all users in the space. The vulnerability affects Kibana versions 7.0.0–7.17.29, 8.0.0–8.19.7, 9.0.0–9.1.7, and 9.2.0–9.2.1. It was disclosed on December 18, 2025, with patches released the same day. It carries a CVSS v3.1 base score of 4.3 (Medium) (Elastic Advisory, Red Hat Bugzilla).

The root cause is Incorrect Authorization (CWE-863), classified under CAPEC-233 (Privilege Abuse). The vulnerability exists in Kibana's document sharing mechanism, where server-side authorization checks fail to properly validate whether the requesting user has permission to change a document's sharing scope to "global." An authenticated attacker can craft a specific HTTP request to modify the sharing type of a document they do not own or have global-sharing rights over, bypassing the intended access control enforcement. No special privileges beyond a standard authenticated session are required, and no user interaction is needed (Elastic Advisory, Red Hat Bugzilla).

Successful exploitation allows an authenticated low-privileged user to expose documents to all users within a Kibana space by changing their sharing type to "global" without authorization. This primarily affects data integrity and confidentiality within the Kibana space, as sensitive dashboards, saved searches, or visualizations could be made visible to unintended audiences. Availability is not impacted, and the scope is limited to the affected Kibana space rather than the broader Elasticsearch cluster (Elastic Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of disclosure. The vulnerability requires an authenticated session, limiting the attack surface to users with at least basic Kibana access. The EPSS score is approximately 0.026% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Elastic Advisory).

1. Authentication: Log in to a vulnerable Kibana instance (versions 7.0.0–7.17.29, 8.0.0–8.19.7, 9.0.0–9.1.7, or 9.2.0–9.2.1) with any valid low-privileged user account.
2. Identify target document: Locate a saved object (e.g., dashboard, saved search, or visualization) within the Kibana space that the attacker wishes to expose globally.
3. Craft malicious HTTP request: Construct an HTTP request targeting the Kibana saved objects API (e.g., POST /api/saved_objects/_update or a similar sharing endpoint) with a payload that sets the document's namespaces or sharing type field to "global" or equivalent.
4. Submit request: Send the crafted request using a tool such as curl or Burp Suite, bypassing the server-side authorization check that should restrict this action to privileged users.
5. Verify exposure: Confirm that the targeted document is now visible to all users in the Kibana space, achieving unauthorized information disclosure (Elastic Advisory, Red Hat Bugzilla).

• Logs: Kibana access logs showing authenticated low-privileged users making API calls to saved objects sharing or update endpoints (e.g., /api/saved_objects/) with sharing type modifications outside normal usage patterns.
• Logs: Unexpected changes to saved object namespaces fields in Kibana audit logs, particularly transitions to a global sharing scope by users without administrative roles.
• Network: Unusual or repeated HTTP POST/PUT requests to Kibana's saved objects API from non-administrative accounts, especially with payloads referencing namespace or sharing type fields.
• Application: Saved dashboards, searches, or visualizations appearing in spaces where they were not previously accessible, or visible to users who should not have access.

Elastic has released patched versions addressing this vulnerability: Kibana 8.19.8, 9.1.8, and 9.2.2. Users running affected versions (7.0.0–7.17.29, 8.0.0–8.19.7, 9.0.0–9.1.7, or 9.2.0–9.2.1) should upgrade to the respective fixed release as soon as possible. No specific configuration-based workaround has been published; upgrading is the recommended remediation. Organizations unable to upgrade immediately should restrict Kibana access to trusted users and monitor audit logs for anomalous saved object sharing activity (Elastic Advisory).

Elastic published the security advisory (ESA-2025-38) on December 18, 2025, alongside the patched releases. Red Hat tracked the issue via Bugzilla as a medium-severity vulnerability. No notable independent researcher commentary, social media discussion, or significant media coverage has been identified beyond standard CVE aggregator postings (Elastic Advisory, Red Hat Bugzilla).