Document Disclosure Flaw in Elasticsearch by Elastic

CVE-2021-22134

What is CVE-2021-22134?

A document disclosure vulnerability in Elasticsearch affects versions after 7.6.0 and before 7.11.0, specifically when using Document or Field Level Security. This flaw allows for GET requests to bypass security permissions when querying documents that have been recently updated but not yet refreshed in the index. Consequently, attackers may gain visibility into documents and fields that they should not have access to, potentially leading to unauthorized disclosure of sensitive information.

References