CVE-2026-63145: Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification

Kibana has an authorization vulnerability (CWE-863, a flaw where access control is not properly enforced) in its Machine Learning feature that allows low-privileged users to modify audit and notification records for ML jobs they shouldn't have access to. The problem occurs because the system checks if a user has general ML permissions but doesn't verify they can access the specific ML job or resource they're trying to modify, letting them exploit Kibana's internal elevated permissions to write to restricted system indices.