Incorrect Authorization in Kibana Affects Synthetic Monitoring

CVE-2026-72673

What is CVE-2026-72673?

The vulnerability in Kibana allows authenticated users with Synthetics write privilege to delete private locations shared across multiple spaces. This occurs due to inadequate access control measures, enabling a user to remove a private location still in use by monitors in other spaces to which they have no access. Consequently, this deletion disrupts availability monitoring for those spaces, as the shared configuration is lost, leading to potential oversight of critical infrastructure health.

References