CVE-2026-102407

Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification

State: Published
Severity: 5.4 Medium
Published: Oct 6, 2026
Updated: Oct 6, 2026
Reserved: Sep 29, 2026

Description

Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data stream to which they were not otherwise authorized, potentially injecting data into it or affecting its ability to be searched normally. This issue does not allow an attacker to read the contents of a data stream they do not otherwise have access to.

Scores

CVSS	Score	Vector	Source
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L	elastic

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
ElasticsearchElastic	7.17.5 through 7.17.29Affected 8.2.2 through 8.19.18Affected 9.0.0 through 9.3.7Affected 9.4.0 through 9.4.3Affected

References

https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-188/390861

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.