CVE-2026-72673 Elastic CVE debrief

Who should care

Elastic Kibana users with Synthetics write privileges, administrators of Kibana instances, and teams relying on Synthetics monitoring should be aware of this vulnerability. They need to assess their exposure, apply patches, and implement additional security measures to prevent unauthorized deletion of private locations. Security teams responsible for vulnerability management and monitoring should also prioritize this issue.

Technical summary

CVE-2026-72673 is an Incorrect Authorization vulnerability in Elastic Kibana that allows an authenticated user with Synthetics write privilege in a single space to delete a private location used by other spaces, potentially disrupting monitoring capabilities. This occurs because the safeguard that prevents deletion of a private location still in use only evaluates monitors visible in the requesting user's own space, ignoring monitors in other spaces that depend on the private location.

Defensive priority

Authenticated users with limited privileges could delete critical configuration affecting multiple spaces.

Recommended defensive actions

• Review and apply vendor-provided patches for Kibana versions 8.0.0 to 8.19.20 and 9.0.0 to 9.4.4.
• Restrict Synthetics write privileges to trusted users and monitor for unusual deletion activities.
• Implement additional access controls and monitoring for Kibana spaces and private locations.
• Conduct a thorough review of current Kibana configurations and Synthetics private locations to identify potential exposure.
• Inventory all systems and spaces that utilize Synthetics monitoring and assess their vulnerability.
• Establish a process for tracking changes to Synthetics private locations and monitor for unauthorized modifications.
• Schedule regular security audits of Kibana environments to detect and address potential vulnerabilities.

Evidence notes

The CVE and NVD records provide details on the vulnerability in Kibana, including its impact and affected versions. Vendor advisory discusses mitigation. Elastic Kibana users should verify their versions and configurations to understand potential exposure. The safeguard that prevented the deletion of a private location still in use evaluated only the monitors visible in the requesting user's own space, so monitors that depend on the private location in other spaces were not taken into account.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.