This vulnerability (CWE-862) in Kibana involves missing authorization checks that permit an authenticated user with scoped Synthetics privileges to permanently delete Synthetics monitors shared across Kibana spaces they do not have access to. Additionally, if the monitor is linked to a private location, the deletion also removes the Elastic Agent integration configuration without the usual Fleet authorization enforcement. The CVSS 3.1 base score is 6.5, indicating a medium severity impact primarily on integrity.

An attacker with authenticated access and Synthetics privileges scoped to a single space can delete monitors in other spaces without authorization, causing loss of monitoring data and potentially disrupting observability. When private locations are involved, the underlying Elastic Agent integration configuration can also be destroyed, which could impact monitoring infrastructure configuration integrity. There is no impact on confidentiality or availability reported.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the Elastic vendor advisory for current remediation guidance. Until a fix is applied, restrict Synthetics privileges carefully and monitor access controls to prevent unauthorized deletions.