Elastic Kibana EUVD-2026-87794

Requires an authenticated Kibana account that already holds Synthetics privileges scoped to at least one space (PR:L) - it cannot be triggered by anonymous or non-Synthetics users. The abusable target is Synthetics monitors that are shared into other spaces the attacker lacks access to; the secondary Fleet-bypass impact (destroying the underlying Elastic Agent integration configuration) applies only to monitors associated with a private location. No user interaction and no special non-default configuration beyond having multiple Kibana spaces with shared Synthetics monitors is needed. Exploitation is limited to within the same Kibana/Elastic deployment (space-to-space), not cross-tenant or cross-organization.

This is a moderate-severity, authenticated authorization flaw (CWE-862 Missing Authorization) in Kibana, not a critical remote-code or data-theft issue. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 6.5) is internally consistent with the description: exploitation is network-reachable but requires an authenticated principal already granted Synthetics privileges (PR:L), and the only impact is integrity/data destruction (I:H) - no confidentiality (C:N) or classic availability (A:N). The A:N choice is debatable: permanently deleting monitors and silently destroying the underlying Elastic Agent integration config for private locations degrades monitoring capability, so a case for A:L exists, but modeling data destruction as integrity is defensible and I agree with the vendor score overall. No EPSS score, no CISA KEV listing, and no public exploit are present in the supplied data, so there is no signal of active or automated exploitation. Real-world risk is bounded by the privilege prerequisite and the intra-cluster (not cross-tenant, not cross-organization) nature of the abuse: the threat is a lower-privileged internal Synthetics operator reaching into spaces they were meant to be walled out of. This is a genuine broken-access-control bug worth patching on a normal cadence rather than an emergency, high-CVSS-but-low-real-risk edge case.

An internal user or compromised account that legitimately holds Synthetics privileges in one Kibana space issues a delete request against Synthetics monitors that are shared into other spaces they were never authorized to see. The deletion succeeds without the expected space-scoped authorization check, and for monitors tied to a private location it also tears down the associated Elastic Agent integration configuration without the checks Fleet would normally enforce. No public proof-of-concept is identified in the available data.