CVE-2026-4818

Some management operations on data streams are not properly restricted when user does not have the necessary privileges

State: Published
Severity: 6.8 Medium
Published: Mar 31, 2026
Updated: Mar 31, 2026
Reserved: Mar 25, 2026

Description

In Search Guard FLX versions from 3.0.0 up to 4.0.1, there exists an issue which allows users without the necessary privileges to execute some management operations against data streams.

Scores

CVSS	Score	Vector	Source
3.1	6.8 Medium	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N	floragunn

Weaknesses

CWE-285
CWE-862

Affected Products

Product	Versions
Search Guard FLXfloragunn	3.0.0 through 4.0.1Affected

References

https://search-guard.com/cve-advisory/
https://docs.search-guard.com/latest/changelog-searchguard-flx-4_1_0

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.