Kibana Synthetics Private Locations Unauthorized Deletion via Incorrect Authorization (CVE-2026-72673)

Vulnerability Overview Vulnerability Name: Incorrect Authorization in Kibana Leading to Unauthorized Deletion of Synthetics Private Locations CVE ID: CVE-2026-72673 CVSSv3.1: Medium (5.4) Issue Type: CWE-863 - Incorrect Authorization Impact: CAPEC-1 - Accessing Functionality Not Properly Constrained by ACLs Affected Scope Affected Versions: - 8.x: All versions up to 8.19.19 (including 8.19.19) - 9.x: All versions from 9.0.0 to 9.4.3 (including 9.4.3) Affected Configurations: - Kibana deployments using Synthetics and sharing private locations across multiple spaces - At least one user with Synthetics write permissions in only some spaces - Single-space deployments are not affected, as there are no cross-space boundaries to bypass - Both self-hosted and Elastic Cloud-hosted deployments are affected - No non-default configurations required Remediation Solution: - Upgrade to version 8.19.20 or 9.4.4 For Users Unable to Upgrade: - Do not share Synthetics private locations across multiple spaces - Grant Synthetics write permissions only to trusted users who have access to all spaces that use the private location Additional Information Related Topics: - Kibana 8.12.1 Security Update (ESA-2024-21) - Kibana 8.19.20, and 9.4.5 Security Update (ESA-2026-92) - Kibana 8.19.14, 9.2.8, 9.3.3 Security Update (ESA-2026-25) - Kibana 9.4.4 Security Update (ESA-2026-73) - Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-88) Code Block No POC code or exploit code is included on the page.

Goal Reached Thanks to every supporter — we hit 100%!

Kibana Synthetics Private Locations Unauthorized Deletion via Incorrect Authorization (CVE-2026-72673)