CVE-2026-103007

Elasticsearch versions 8.x (8.16.0 to 8.19.21) and 9.x (9.0.0 to 9.4.6, 9.5.0 to 9.5.3) are vulnerable to Incorrect Authorization (CWE-863) . The flaw exists in a configurable, non-default privilege that allows administrators to delegate limited role-management capabilities. Specifically, the aut...

CVE-2026-103007 Incorrect Authorization in Elasticsearch Leading to Privilege Escalation

Incorrect Authorization CWE-863 in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets a...