Aller au contenu
en Se connecter
4.3 Moyenne

CVE-2026-115298 Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not…

Description

Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user whose index access is restricted by field-level security can retrieve the value of a constant_keyword field that their role excludes. Some search and query features do not apply the field-level security restriction to this field type.

Produits et versions touchés

Produit Versions touchées Corrigé en
Elasticsearch 9.5 9.5.0 → 9.5.5 Pas de correctif indiqué
Elasticsearch 9.0 9.0.0 → 9.4.8 Pas de correctif indiqué
Elasticsearch 8.0 8.0.0 → 8.19.23 Pas de correctif indiqué

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Elasticsearch

Les 91 CVE de Elasticsearch →
CVE-2026-115715 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to denial of service via a… 6.5 Moyenne CVE-2026-115710 Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to information disclosure and… 4.2 Moyenne CVE-2026-115290 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads… 7.5 Élevée CVE-2026-103009 Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a… 7.1 Élevée
Suivre cette CVE