CVE-2026-115298

Incorrect Authorization CWE-863 in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user whose index access is restricted by field-level security can retrieve the value of a constantkeyword field that their rol...

CVE-2026-115298 Incorrect Authorization in Elasticsearch Leading to Information Disclosure

Incorrect Authorization CWE-863 in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user whose index access is restricted by field-level security can retrieve the value of a constantkeyword field that their rol...

EUVD-2026-116078

Incorrect Authorization CWE-863 in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user whose index access is restricted by field-level security can retrieve the value of a constantkeyword field that their rol...

CVE-2026-115298

Elasticsearch is vulnerable to an Incorrect Authorization (CWE-863) issue that allows for information disclosure via improperly constrained ACLs (CAPEC-1). Specifically, authenticated users whose access is restricted by field-level security can retrieve values of constant_keyword fields that thei...

Elasticsearch 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-209)

Incorrect Authorization in Elasticsearch Leading to Information Disclosure Incorrect Authorization CWE-863 in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user whose index access is restricted by field-leve...