CVE-2026-102407

A vulnerability in Elasticsearch (CWE-863) allows an authenticated user with sufficient privileges over a single resource to modify a data stream to which they are not authorized. By using the Modify Data Streams API , an attacker can potentially inject data or affect searchability, though they c...

CVE-2026-102407 Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification

Incorrect Authorization CWE-863 in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data...

EUVD-2026-93928

Incorrect Authorization CWE-863 in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data...