CVE-2026-102407

Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-13

Assigner: Elastic

Description

Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data stream to which they were not otherwise authorized, potentially injecting data into it or affecting its ability to be searched normally. This issue does not allow an attacker to read the contents of a data stream they do not otherwise have access to.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102407

EUVD

EUVD-2026-93928

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	From 9.0.0 (inc) to 9.3.8 (exc)
elastic	elasticsearch	From 9.4.0 (inc) to 9.4.4 (exc)
elastic	elasticsearch	From 7.17.5 (inc) to 7.17.29 (inc)
elastic	elasticsearch	From 8.2.2 (inc) to 8.19.19 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability is an Incorrect Authorization issue in Elasticsearch that allows authenticated users with sufficient privileges over a single resource to modify a data stream they are not authorized to access. It involves exploiting Accessing Functionality Not Properly Constrained by ACLs to use the Modify Data Streams API for unauthorized changes. The attacker cannot read data from streams they lack access to.

Detection Guidance

This vulnerability involves incorrect authorization in Elasticsearch, allowing unauthorized data stream modifications. To detect it, review Elasticsearch logs for unauthorized use of the Modify Data Streams API. Check for unusual modifications to data streams by authenticated users with insufficient privileges. No specific commands are provided in the context.

Impact Analysis

An attacker could inject malicious data into unauthorized data streams or disrupt normal search functionality. This may lead to data corruption, incorrect search results, or denial of service for legitimate users. The impact is limited to modification and does not include data theft.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and data integrity, such as GDPR's data protection principles or HIPAA's safeguards for protected health information. Unauthorized data modifications may lead to regulatory penalties or loss of certification.

Mitigation Strategies

Review and restrict user privileges to ensure proper authorization for data stream modifications. Monitor API access logs for unusual Modify Data Streams API usage. Apply security patches or updates from Elasticsearch as soon as they become available.

Hi! I’m here to help you understand CVE-2026-102407. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70