CVE-2026-72673

CVE-2026-72673 is an authorization bypass in Kibana's monitor management API where deleting a private location succeeds if the requester has access to that location in their own space, regardless of whether monitors in other spaces depend on it. The vulnerability isn't a missing check — it's the wrong check. The safeguard validated 'is this resource visible to the user in their space' when it should have validated 'is this resource in use by any monitor across any space.' That's a structural category error, not an oversight. Private locations exist outside Kibana's space isolation model by design — they're explicitly cross-space shared resources. But the authorization logic reused the same primitives (user context, space context, visibility checks) that work correctly for space-scoped resources. When an abstraction doesn't match the resource model, developers write code that respects the abstraction, not the reality. The protection operated at the space-user-visibility layer when it needed to operate at the resource-dependency layer. The consequence model is asymmetric in a way that should concern you: Space B loses monitoring availability with no notification, no visible audit trail, and no recourse. The deletion is entirely legitimate from Space A's perspective — the authorization check passed, the user's privileges were correct, the logs are clean. Space B simply stops receiving monitor data and has no way to know why. This silent service degradation is the vulnerability's most dangerous characteristic. Downstream systems that trusted Space B's monitoring now have false confidence in their operational health, and the temporal offset between cause (deletion in Space A) and visible consequence (missing alerts in Space B) makes detection nearly impossible through normal channels. Your Kibana instance likely has audit logging enabled, but verify whether deletion events for private locations capture downstream impact. If the audit trail shows only a clean deletion with no dependency context recorded, you have no reliable forensic path to identify this attack class — you can only detect the symptom (monitoring gaps) with no path to the cause. This is a known gap in how shared-resource deletions are audited across multi-tenant systems. To verify the fix: query the patched API endpoint directly attempting to delete a private location that monitors in other spaces depend on, and confirm the request is rejected. Also validate that the fix queries all space dependencies, not just the caller's context. Monitor your audit logs to confirm the rejection event includes sufficient context about the blocked dependency. Beyond patching, implement alerting on monitor count or state changes per space — if a space's monitor inventory drops unexpectedly, that's your detection surface. The EPSS score of 0.00209 indicates low probability of active exploitation, but that assumes attackers lack knowledge of this specific misconfiguration path. Organizations with sensitive availability-monitoring dependencies should treat this as higher practical risk than the score suggests.

Reviewed through automated stages and approved by a human before publication.