Executive brief
Kibana, Elastic's web-based analytics and visualization platform, contains an authorization flaw that allows authenticated users to delete Synthetics monitors (synthetic test configurations) they should not have access to. A user with limited permissions in one Kibana space can delete shared monitors across other spaces and destroy associated agent configurations, leading to loss of monitoring capabilities and data.
Technical details
A missing authorization check (CWE-862) in Kibana's Synthetics API allows authenticated users with Synthetics privileges scoped to a single space to delete monitors shared into spaces where they lack authorization. When monitors are linked to private locations, the deletion also destroys Fleet integration configurations without triggering Fleet's own authorization checks. Attack requires authentication, network access, and a multi-space Kibana deployment with shared Synthetics monitors.
Affected products
- Elastic Kibana 7.12.0 to 7.17.29, 8.0.0 to 8.19.21, 9.0.0 to 9.4.6, 9.5.0 to 9.5.2
Timeline
- 2026-09-26: disclosed: Security advisory ESA-2026-139 published
- 2026-09-26: patched: Fixed in Kibana 8.19.22, 9.4.7, 9.5.3