CVE-2026-115712
CVE-2026-115712 · Incorrect Authorization in Elastic Cloud Enterprise (ECE) Leading to Unauthorized Modification of Platform Settings
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of platform-level settings via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read-only access to the platform can change an installation-wide account setting that only platform administrators are permitted to change.
CVSS 4.3 · Medium · EPSS 0.2%
- Published
- Updated
Affected products and versions
elastic cloud enterprise
- Versions
- ≥ 3.8.0, ≤ 3.8.5: Affected (semver)
- ≥ 4.0.0, ≤ 4.2.0: Affected (semver)
No fix published