CVE-2026-103007

Awaiting Analysis Awaiting Analysis - Queue

Incorrect Authorization in Elasticsearch Leads to Privilege Escalation

Publication date: 2026-10-06

Last updated on: 2026-10-09

Assigner: Elastic

Description

Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator delegate limited role-management capability to another user, scoped to specific indices. The authorization check that enforces this scoping does not correctly account for a role-definition setting that can expand the matched index set. A user holding this delegated privilege with a broadly-scoped index pattern can exploit this inconsistency by updating their own assigned role to gain access to indices that should remain restricted, including internal security data. This can enable further escalation up to full administrative control of the cluster.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-09

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103007

EUVD

EUVD-2026-93937

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	From 9.0.0 (inc) to 9.4.7 (exc)
elastic	elasticsearch	From 9.5.0 (inc) to 9.5.4 (exc)
elastic	elasticsearch	From 8.16.0 (inc) to 8.19.22 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This is an Incorrect Authorization vulnerability (CWE-863) in Elasticsearch that allows privilege escalation. It involves a delegated administrative privilege with insufficient enforcement during authorization checks. A non-default privilege lets an admin delegate limited role-management capability to another user, scoped to specific indices. However, the authorization check fails to account for a role-definition setting that can expand the matched index set. This lets a user with the delegated privilege update their own role to access restricted indices, including internal security data, potentially leading to full cluster control.

Detection Guidance

This vulnerability involves incorrect authorization in Elasticsearch due to a delegated privilege scope issue. To detect it, check for users with delegated role-management privileges and verify if their assigned roles grant access to unintended indices. Review Elasticsearch logs for unauthorized role modifications or access attempts to restricted indices. Use Elasticsearch APIs like _security/role_mapping or _security/role to inspect role definitions and permissions.

Impact Analysis

If you are an Elasticsearch user with delegated administrative privileges, an attacker could exploit this to gain unauthorized access to sensitive data or escalate privileges to full administrative control of the cluster. This could lead to data breaches, unauthorized modifications, or complete system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR (data protection) and HIPAA (health information privacy). It may result in data breaches, unauthorized disclosures, or lack of proper access controls, leading to regulatory penalties or legal consequences.

Mitigation Strategies

Disable the non-default delegated role-management privilege if enabled. Review assigned roles for users with delegated privileges to ensure index scoping is correctly enforced. Update Elasticsearch to the latest patched version as soon as possible.

Hi! I’m here to help you understand CVE-2026-103007. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70