CVE-2026-72673

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>kibana91</name>
	<range><lt>8.19.20</lt></range>
      </package>
      <package>
	<name>kibana92</name>
	<range><lt>8.19.20</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized
	deletion of Synthetics private locations via Accessing Functionality
	Not Properly Constrained by ACLs (CAPEC-1). Synthetics private
	locations can be shared with more than one space, and deleting one
	removes it from every space it is shared with. The safeguard that
	prevented the deletion of a private location still in use evaluated
	only the monitors visible in the requesting user's own space, so
	monitors that depend on the private location in other spaces were not
	taken into account. As a result, an authenticated Kibana user holding
	the Synthetics write privilege in a single space could delete a
	private location that other spaces still depend on, even where the
	user has no access to those spaces. Deleting the private location
	removes the shared configuration and stops the monitors in the other
	spaces from running, which suppresses the availability monitoring
	those spaces rely on.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-72673</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-72673</url>
    </references>
    <dates>
      <discovery>2026-08-13</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>