CVE-2026-72673

Name of the Vulnerable Software and Affected Versions Kibana (affected versions not specified)

Description An incorrect authorization issue exists where functionality is not properly constrained by Access Control Lists (ACLs). This allows an authenticated user with Synthetics write privileges in one space to delete Synthetics private locations shared across multiple spaces. Because the system only checks for monitors in the user's current space before allowing deletion, it ignores dependencies in other spaces. Consequently, a user can delete a private location used by spaces they cannot access, removing shared configurations and stopping critical availability monitoring.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.