CVE-2026-102407

Published: Oct 6, 2026Modified: Oct 13, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Exploitability: 2.8 / Impact: 2.5

Source: security@elastic.co (Secondary)

Description

Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data stream to which they were not otherwise authorized, potentially injecting data into it or affecting its ability to be searched normally. This issue does not allow an attacker to read the contents of a data stream they do not otherwise have access to.

Affected (4)

Products: Elastic: Elasticsearch

Elastic

1 product

Elasticsearch

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Elastic Elasticsearch	7.17.5 ≤ version ≤ 7.17.29
Elastic Elasticsearch	8.2.2 ≤ version < 8.19.19
Elastic Elasticsearch	9.0.0 ≤ version < 9.3.8
Elastic Elasticsearch	9.4.0 ≤ version < 9.4.4

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (1)

https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-188/390861

Source: security@elastic.co

Vendor Advisory

Timeline

No history available yet.