CVE-2025-68386
📋 TL;DR
This vulnerability allows authenticated Kibana users to escalate privileges by changing document sharing settings to 'global', making documents visible to all users in a space. It affects Kibana instances with authenticated users who have document access but not global sharing permissions. The impact is unauthorized data exposure within shared spaces.
💻 Affected Systems
- Kibana
📦 What is this software?
Kibana by Elastic
Kibana by Elastic
Kibana by Elastic
Kibana by Elastic
⚠️ Risk & Real-World Impact
Worst Case
Sensitive documents intended for limited audiences become globally visible within a space, potentially exposing confidential data to unauthorized users.
Likely Case
Unauthorized users gain read access to documents they shouldn't see, violating data confidentiality and potentially exposing sensitive information.
If Mitigated
With proper access controls and monitoring, impact is limited to unauthorized document visibility within a single space.
🎯 Exploit Status
Exploitation requires authenticated access and knowledge of document IDs
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kibana 8.19.8, 9.1.8, or 9.2.2
Vendor Advisory: https://discuss.elastic.co/t/kibana-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-38/384186
Restart Required: Yes
Instructions:
1. Download Kibana 8.19.8, 9.1.8, or 9.2.2 from Elastic website. 2. Stop Kibana service. 3. Backup configuration and data. 4. Install updated version. 5. Restart Kibana service. 6. Verify functionality.
🔧 Temporary Workarounds
Restrict Document Permissions
allTighten document-level permissions to limit which users can modify sharing settings
Configure Kibana role-based access control to restrict 'share' permissions
🧯 If You Can't Patch
- Implement strict role-based access control to limit document modification permissions
- Monitor Kibana audit logs for unauthorized sharing activity
🔍 How to Verify
Check if Vulnerable:
Check Kibana version via web interface or command line: ./bin/kibana --versionCheck Version:
./bin/kibana --versionVerify Fix Applied:
Verify Kibana version is 8.19.8, 9.1.8, or 9.2.2 or higher📡 Detection & Monitoring
Log Indicators:
- Unauthorized document sharing events in Kibana audit logs
- Multiple document visibility changes from single user
Network Indicators:
- HTTP POST requests to document sharing endpoints with 'global' parameter
SIEM Query:
source="kibana" AND (event.action:"share" OR event.category:"access") AND http.request.method:POST AND url.path:"/api/saved_objects/*"