{"data":{"id":"d41769c4-0cc7-4864-8888-540a2fea7548","title":"CVE-2026-115292: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information…","summary":"An authenticated user with Machine Learning read access in one Kibana space can read audit and error messages of data frame analytics jobs in other spaces they are not authorized to access. The flaw is an authorization bypass through a user-controlled key (CWE-639). Exposed messages can include destination index names, analyzed field names and failure information.","solution":"N/A -- no mitigation discussed in source.","labels":["security","privacy"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115292","publishedAt":"2026-11-03T17:17:55.077Z","cveId":"CVE-2026-115292","cweIds":["CWE-639"],"cvssScore":"4.3","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Kibana Machine Learning"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Kibana Machine Learning authorization bypass exposes analytics job messages","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-11-04T12:08:34.077Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-03T18:10:44.745Z","patchAvailable":null,"disclosureDate":"2026-11-03T17:17:55.077Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[]}}