Skip to content
fr Sign in
4.3 Medium

CVE-2026-115712 Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of…

Description

Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of platform-level settings via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read-only access to the platform can change an installation-wide account setting that only platform administrators are permitted to change.

Affected products and versions

Product Affected versions Fixed in
Elastic Cloud Enterprise 4.0 4.0.0 → 4.2.0 No fix stated
Elastic Cloud Enterprise 3.8 3.8.0 → 3.8.5 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Elastic Cloud Enterprise

The 13 CVEs of Elastic Cloud Enterprise →
CVE-2026-115713 Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to… 7.5 High CVE-2026-115711 Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise… 6.4 Medium CVE-2026-115709 Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to… 8.2 High CVE-2026-115708 Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to… 7.2 High
Track this CVE