{"data":{"id":"2a3d0e85-46f3-4449-8fa6-99101d617408","title":"CVE-2026-63145: Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification…","summary":"CVE-2026-63145 is an Incorrect Authorization flaw (CWE-863) in Kibana's Machine Learning functionality. A Machine Learning management endpoint checks only a coarse privilege level and does not verify access to the specific job or notification resources in the request. A low-privileged user with Machine Learning access in any Kibana space can therefore alter audit and notification records for arbitrary jobs, including jobs in other spaces or owned by other users, by using Kibana's internally elevated credentials to write to restricted Machine Learning system indices.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63145","publishedAt":"2026-07-21T23:18:02.460Z","cveId":"CVE-2026-63145","cweIds":["CWE-863"],"cvssScore":"4.3","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Kibana Machine Learning"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Kibana Machine Learning endpoint lets users alter audit and notification records","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00268,"epssCheckedAt":"2026-11-12T18:09:39.179Z","kevDateAdded":null,"advisoryAliases":["GHSA-q5gv-xxq5-3m7c"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-09T18:09:55.824Z","patchAvailable":null,"disclosureDate":"2026-07-21T23:18:02.460Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-122"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[]}}