Skip to content
fr Sign in
4.3 Medium

CVE-2026-115298 Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not…

Description

Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user whose index access is restricted by field-level security can retrieve the value of a constant_keyword field that their role excludes. Some search and query features do not apply the field-level security restriction to this field type.

Affected products and versions

Product Affected versions Fixed in
Elasticsearch 9.5 9.5.0 → 9.5.5 No fix stated
Elasticsearch 9.0 9.0.0 → 9.4.8 No fix stated
Elasticsearch 8.0 8.0.0 → 8.19.23 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Elasticsearch

The 91 CVEs of Elasticsearch →
CVE-2026-115715 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to denial of service via a… 6.5 Medium CVE-2026-115710 Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to information disclosure and… 4.2 Medium CVE-2026-115290 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads… 7.5 High CVE-2026-103009 Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a… 7.1 High
Track this CVE