CVE-2026-78582: Missing Authorization in Kibana Leading to Unauthorized Deletion of Data
Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that are shared into spaces they have no access to. Where a monitor is associated with a private location, the same operation also destroys the underlying Elastic Agent integration configuration without the authorization checks that Fleet would otherwise apply.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with Synthetics privileges limited to one Kibana space can exploit it. The impact applies when monitors are shared into other spaces that the user is not authorized to access.
What can an attacker delete?
The user can permanently delete shared Synthetics monitors in spaces outside their access scope. If a deleted monitor uses a private location, the operation also destroys its underlying Elastic Agent integration configuration.
Is additional Fleet authorization enforced for private-location monitors?
No. In the affected operation, the underlying Elastic Agent integration configuration can be destroyed without the Fleet authorization checks that would otherwise apply.