CVE-2026-33463
Medium · 5.3CVSS
5.3
EPSS
0.4%
Published
May 28, 2026
CISA due date
—
The record
Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time-bounded access token to remain usable beyond its intended validity window, enabling an unauthenticated actor in possession of the token to retrieve the associated content after expiration.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-98124 In the Linux kernel, the following vulnerability has been resolved: smb/client… CWE-672
- CVE-2026-98080 In the Linux kernel, the following vulnerability has been resolved: btrfs: do not force… CWE-672
- CVE-2026-55250 Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0… CWE-672
- CVE-2026-53637 Sylius is an Open Source eCommerce Framework on Symfony. CWE-672
- CVE-2026-61699 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. CWE-672
- CVE-2026-85044 Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82… CWE-672
- CVE-2026-19538 The BLOCKED access control list items that are evaluated to deny access on the the proxy… CWE-672
- CVE-2026-79010 Operation on a resource after expiration or release in Network in Google Chrome prior to… CWE-672