CVE-2025-25010: Elastic Kibana Privilege Escalation Flaw

CVE-2025-25010 Overview

CVE-2025-25010 is an incorrect authorization vulnerability in Elastic Kibana. The built-in reporting_user role incorrectly grants access to all Kibana Spaces, bypassing intended space-level isolation. An authenticated user holding this role can read data in spaces they were not meant to access, enabling horizontal privilege escalation and unauthorized information disclosure. The flaw is tracked under CWE-863: Incorrect Authorization and was addressed in Kibana 9.0.6 and 9.1.3 via Elastic Security Advisory ESA-2025-13.

Critical Impact
Authenticated users with the reporting_user role can access data across all Kibana Spaces, breaking tenant and workspace isolation and exposing sensitive dashboards, saved objects, and indexed data.

Affected Products

Elastic Kibana versions prior to 9.0.6
Elastic Kibana 9.1.x versions prior to 9.1.3
Deployments relying on Kibana Spaces for tenant or team isolation

Discovery Timeline

2025-08-28 - CVE CVE-2025-25010 published to NVD
2025-08-28 - Elastic publishes security advisory ESA-2025-13 with fixes in Kibana 9.0.6 and 9.1.3
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-25010

Vulnerability Analysis

Kibana Spaces provide logical isolation for dashboards, visualizations, saved objects, and index-level views. Each space is intended to enforce authorization boundaries so users only access assets within their assigned spaces. The reporting_user built-in role is designed to let users generate and download reports from the spaces they are entitled to.

In affected versions, the reporting_user role carries an implicit grant that allows access to every space in the deployment. This authorization defect lets any user with the reporting_user role traverse spaces they were never explicitly assigned. The result is unauthorized read access to data belonging to other tenants, teams, or business units sharing the same Kibana instance.

The vulnerability affects confidentiality only. Integrity and availability are not impacted according to the published CVSS vector.

Root Cause

The root cause is an incorrect role definition for the built-in reporting_user role. The role authorization checks do not enforce space membership before granting access to space-scoped resources. This is a classic [CWE-863] authorization logic flaw where a privilege intended to be narrow was defined too broadly.

Attack Vector

Exploitation requires network access to the Kibana web interface and valid credentials for an account assigned the reporting_user role. An attacker authenticates to Kibana, enumerates available spaces through the Spaces API or UI, and then queries saved objects, dashboards, or report data within spaces they should not see. No user interaction and no additional privileges are required beyond holding the vulnerable role.

The vulnerability is particularly impactful in multi-tenant deployments where Kibana Spaces are the primary isolation mechanism between business units or customers. See the Elastic Security Update ESA-2025-13 for vendor-confirmed technical details.

Detection Methods for CVE-2025-25010

Indicators of Compromise

Access log entries showing requests from reporting_user accounts to space identifiers that are not part of their documented assignment
Unexpected calls to the Kibana Spaces API (/api/spaces/space) from accounts without administrative roles
Report generation jobs referencing dashboards or saved objects outside a user's expected space scope

Detection Strategies

Audit Kibana role assignments and flag every account that currently holds the built-in reporting_user role
Correlate Kibana audit logs with user-to-space mapping to detect cross-space resource access
Baseline normal space access patterns per user and alert on deviations, especially bulk saved-object reads

Monitoring Recommendations

Enable Kibana audit logging and forward events to a centralized SIEM for long-term analysis
Monitor Elasticsearch security audit logs for requests originating from Kibana service accounts targeting unexpected indices
Track Kibana version strings during asset inventory scans to ensure patched builds (9.0.6, 9.1.3, or later) are deployed

How to Mitigate CVE-2025-25010

Immediate Actions Required

Upgrade Kibana to version 9.0.6, 9.1.3, or later as specified in ESA-2025-13
Inventory all users and API keys assigned the built-in reporting_user role and remove it where not strictly required
Review Kibana audit logs for prior cross-space access by reporting_user accounts and treat confirmed cases as potential data exposure incidents

Patch Information

Elastic released fixed versions 9.0.6 and 9.1.3 that correct the reporting_user role definition to respect Kibana Space boundaries. Patch details and release notes are published in the Elastic Security Advisory ESA-2025-13. Administrators running self-managed Kibana should upgrade promptly. Elastic Cloud customers should confirm their deployment has been updated to a patched version.

Workarounds

Replace the built-in reporting_user role with a custom role scoped to specific spaces and granting only the required reporting privileges
Restrict Kibana access at the network layer so only trusted users can reach the UI and APIs while patching is planned
Rotate credentials and API keys for accounts that previously held reporting_user after upgrading, if cross-space access is suspected

bash

# Example: create a space-scoped custom reporting role via the Kibana API
curl -X PUT "https://kibana.example.com/api/security/role/custom_reporting" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -u admin:$ADMIN_PASSWORD \
  -d '{
    "elasticsearch": { "indices": [] },
    "kibana": [
      {
        "base": [],
        "feature": { "discover": ["read"], "dashboard": ["read"] },
        "spaces": ["team-alpha"]
      }
    ]
  }'