CVE-2025-68386
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-68386
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68386.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-68386
- Aliases
- Published
- 2025-12-18T23:15:49.160Z
- Modified
- 2025-12-25T03:45:28.516934Z
- Severity
-
- 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not have permission to do so, making it visible to everyone in the space via a crafted a HTTP request.
- References
Affected packages
Git / github.com/elastic/elasticsearch
Database specific
vanir_signatures
[
{
"digest": {
"length": 533.0,
"function_hash": "87673803415819436679596541002810312405"
},
"id": "CVE-2025-68386-7e790cab",
"source": "https://github.com/elastic/elasticsearch/commit/e34ace04b64e9bfa3f9e785b08e6d81f8efe314b",
"signature_type": "Function",
"target": {
"file": "libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/DerParser.java",
"function": "getLength"
},
"signature_version": "v1",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"51550193863884045934320633866015297104",
"331630246968815451063354319351946329234",
"186592295080528027987154635525856192062",
"75995982543764003382939960430245009492"
]
},
"id": "CVE-2025-68386-ec99c0f8",
"source": "https://github.com/elastic/elasticsearch/commit/e34ace04b64e9bfa3f9e785b08e6d81f8efe314b",
"signature_type": "Line",
"target": {
"file": "libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/DerParser.java"
},
"signature_version": "v1",
"deprecated": false
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68386.json"