Description

Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Synthetics private locations can be shared with more than one space, and deleting one removes it from every space it is shared with. The safeguard that prevented the deletion of a private location still in use evaluated only the monitors visible in the requesting user's own space, so monitors that depend on the private location in other spaces were not taken into account. As a result, an authenticated Kibana user holding the Synthetics write privilege in a single space could delete a private location that other spaces still depend on, even where the user has no access to those spaces. Deleting the private location removes the shared configuration and stops the monitors in the other spaces from running, which suppresses the availability monitoring those spaces rely on.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-13T20:17:27.893Z",
  "pubdate": "2026-08-13T20:17:27.893Z",
  "executiveSummary": "An Incorrect Authorization vulnerability (CWE-863) has been identified in Kibana, specifically related to the management of Synthetics private locations. This flaw allows an authenticated user with limited privileges in a single space to cause the unauthorized deletion of shared Synthetics private locations across multiple spaces, leveraging Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). The vulnerability stems from an improper evaluation of dependencies during the deletion safeguard process, which only checks monitors visible within the requesting user's local space rather than across all associated spaces. Consequently, an attacker holding the Synthetics write privilege in a single space can bypass cross-space access restrictions and delete resources relied upon by other administrative domains. The risk implication includes operational disruption and denial of availability monitoring for dependent spaces. Exploitation requires authenticated access to Kibana with Synthetics write privileges in at least one space where the shared private location is accessible.",
  "technicalDetails": "The vulnerability resides in the access control and dependency validation logic governing Synthetics private locations in Kibana. Synthetics private locations possess the capability to be shared across multiple Kibana spaces. When a user initiates a deletion request for a private location, the system is designed to execute a safeguard check to prevent the removal of resources that are still actively utilized by dependent monitors.\nThe root cause of the vulnerability is that the safeguard logic evaluates only the monitors visible within the requesting user's own space. It fails to account for monitors residing in other spaces that also depend on the shared private location. Because of this improper constraint handling, the access control list (ACL) enforcement mechanism incorrectly permits the deletion operation based solely on local visibility.\nThe step-by-step attack flow proceeds as follows: First, an authenticated attacker obtains or utilizes an account holding the Synthetics write privilege in a single, isolated Kibana space. Second, the attacker identifies or targets a Synthetics private location that is shared with other spaces where the attacker possesses no privileges or access. Third, the attacker issues a deletion request for the target private location through the Kibana interface or API. Fourth, the backend validation logic checks for active monitors solely within the attacker's authorized space. Finding no local dependencies, the validation passes. Fifth, the system executes the deletion command, which removes the shared configuration globally across all spaces.\nThe exploitation vector requires authentication and low-level write privileges (Synthetics write privilege) within a single Kibana space, operating over the standard network protocols used by Kibana. The post-exploitation impact includes the abrupt halting of dependent monitors in all associated spaces, resulting in the suppression of critical availability monitoring and potential operational blindness for administrators in the affected external spaces."
}