CVE-2026-103007
Elasticsearch: incorrect authorisation can lead to privilege escalation
- Risk score
- 48/100
- CVSS
- 7.2 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 6 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator dele…
- Affected
- Elasticsearch
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Elasticsearch: Yellow, plan it in. Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator dele…
The flaws
- CVE-2026-103007: Incorrect authorisation can lead to privilege escalation (CVSS 7.2 · EPSS 0%)
- CVE-2026-82294: Denial of service (CVSS 6.5 · EPSS 0%)
- CVE-2026-82300: Denial of service (CVSS 6.5 · EPSS 0%)
- CVE-2026-94396: Denial of service (CVSS 6.5 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Elasticsearch
Where it stands
- No known exploitation
Connects to
- Same weakness: Incorrect authorisation (CWE-863). 336 other warnings in 30 days
- Same product: Earlier Elasticsearch warnings. 13 in the last 90 days
Why it is Yellow
- CVSS 7.2 high
References
Original description
Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator delegate limited role-management capability to another user, scoped to specific indices. The authorization check that enforces this scoping does not correctly account for a role-definition setting that can expand the matched index set. A user holding this delegated privilege with a broadly-scoped index pattern can exploit this inconsistency by updating their own assigned role to gain access to indices that should remain restricted, including internal security data. This can enable further escalation up to full administrative control of the cluster.
Last activity 6 Oct 2026. Patch Forecast updates every hour.