CVE-2026-103007

Elasticsearch versions 8.x (8.16.0 to 8.19.21) and 9.x (9.0.0 to 9.4.6, 9.5.0 to 9.5.3) are vulnerable to Incorrect Authorization (CWE-863) . The flaw exists in a configurable, non-default privilege that allows administrators to delegate limited role-management capabilities. Specifically, the aut...