EUVD-2026-58260
GHSA-39jx-7xf9-qq62
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
PR:L confirmed by requirement for Synthetics write privilege; S:U retained as Kibana remains the single authorization authority despite cross-space impact; C:N as no data disclosure occurs.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
2DescriptionCVE.org
Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Synthetics private locations can be shared with more than one space, and deleting one removes it from every space it is shared with. The safeguard that prevented the deletion of a private location still in use evaluated only the monitors visible in the requesting user's own space, so monitors that depend on the private location in other spaces were not taken into account. As a result, an authenticated Kibana user holding the Synthetics write privilege in a single space could delete a private location that other spaces still depend on, even where the user has no access to those spaces. Deleting the private location removes the shared configuration and stops the monitors in the other spaces from running, which suppresses the availability monitoring those spaces rely on.
AnalysisAI
Incorrect authorization in Kibana's Synthetics feature allows an authenticated user holding only Synthetics write privilege in a single space to permanently delete private locations shared across multiple spaces, including those the user has no access to. The root cause is an incomplete access-control check that evaluates only the monitors visible in the requesting user's own space, ignoring dependent monitors in other spaces. No public exploit or active exploitation has been identified; the CVSS 5.4 score reflects a real but bounded integrity and availability impact limited to Elastic Kibana instances using multi-space Synthetics deployments.
Technical ContextAI
Kibana (CPE: cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*) is the visualization and management layer of the Elastic Stack. Its Synthetics feature enables uptime and availability monitoring via private locations - runner agents that can be shared across multiple Kibana spaces (organizational tenancy boundaries). The vulnerability is classified as CWE-863 (Incorrect Authorization) and maps to CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs). The authorization defect is a scoping error in the pre-deletion safety check: the code queries only monitors within the requester's space to determine whether the private location is in use, rather than querying across all spaces that reference the shared location. This incomplete predicate allows the delete operation to succeed even when dependent monitors in unrelated spaces exist, destroying a shared infrastructure resource through an insufficiently guarded API endpoint.
RemediationAI
Upgrade Kibana to version 8.19.20 (for the 8.x release line) or 9.4.4 (for the 9.x release line), as detailed in the Elastic advisory ESA-2026-90 at https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-4-security-update-esa-2026-90/389518. These are vendor-released patched versions that correct the cross-space authorization check. If immediate upgrade is not feasible, a compensating control is to restrict the Synthetics write privilege to only fully trusted operators and avoid sharing private locations across spaces until patched - the trade-off is reduced operational flexibility and the need to provision separate private locations per space. Auditing existing Kibana role assignments for over-provisioned Synthetics write access is recommended regardless of patch timing.
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. Rated criti
Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. Rated hig
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. Rated critical s
Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP
Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are us
A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine lea
Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. Rated critical sever
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. Rate
Privilege escalation in Elastic Kibana's Agent Builder component (versions 9.4.0-9.4.3) allows authenticated low-privile
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document con
Kibana version 8.7.0 contains an arbitrary code execution flaw. Rated high severity (CVSS 8.8), this vulnerability is re
Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. Rated high severity (CVSS 8.8), this vulne
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today