The vulnerability in Elastic Kibana's Machine Learning feature allows users with create privileges for anomaly detection and data frame analytics jobs, but lacking trained model privileges, to remove trained models from a specific space. The authorization check only verifies privileges related to anomaly detection and data frame analytics jobs, omitting trained model privileges. Consequently, unauthorized users can remove trained models from spaces without deleting the model itself. The model remains available in other spaces and can be restored by authorized users.

An attacker with limited privileges can remove trained machine learning models from a space, potentially disrupting workflows or causing confusion. However, the models are not deleted and remain accessible in other spaces, and the removal can be reversed by authorized users. There is no direct confidentiality or availability impact to the models themselves.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles to ensure that only users with trained model privileges can remove trained models from spaces. Monitor role assignments to prevent unauthorized privilege combinations.