CVE-2026-115712
CVE-2026-115712 · Incorrect Authorization in Elastic Cloud Enterprise (ECE) Leading to Unauthorized Modification of Platform Settings
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of platform-level settings via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read-only access to the platform can change an installation-wide account setting that only platform administrators are permitted to change.
CVSS 4.3 · Media · EPSS 0,2%
- Publicación
- Actualización
Productos y versiones afectados
elastic cloud enterprise
- Versiones
- ≥ 3.8.0, ≤ 3.8.5: Afectada (semver)
- ≥ 4.0.0, ≤ 4.2.0: Afectada (semver)
Sin corrección publicada