Elk: Incorrect Authorization in Kibana Leading to Unauthorized Deletion of Synthetics Private Locations (CVE-2026-72673)

CVE-2026-72673 describes an incorrect authorization vulnerability in Kibana's Synthetics feature. The vulnerability stems from improper access control checks when deleting private locations shared across multiple spaces. The safeguard mechanism only considers monitors in the requesting user's space, allowing deletion of private locations still in use by monitors in other spaces where the user lacks access. This results in unintended removal of shared configurations and halts monitoring in those other spaces.

An authenticated user with Synthetics write privileges in a single Kibana space can delete private locations that other spaces depend on without authorization. This action removes the shared configuration and stops monitors in other spaces from running, suppressing availability monitoring and potentially impacting operational awareness in those spaces.

A patch is available to address this vulnerability. Users should apply the official fix to ensure proper authorization checks across all spaces sharing private locations. Since this is not a cloud service, remediation requires updating affected Kibana instances to a fixed version.