Improper Authorization in Elasticsearch by Elastic

CVE-2026-103007

What is CVE-2026-103007?

Elasticsearch contains a flaw that allows for privilege escalation through incorrect authorization management. Administrators can delegate role management capabilities to users scoped to specific indices, but the authorization checks fail to fully enforce these limitations. This inconsistency allows users with broad index patterns to exploit their delegated privileges. As a result, they may update roles to gain access to restricted indices, risking exposure of sensitive internal security data and potentially escalating their control to full administrative privileges over the cluster.

References