CVE-2026-102407
published 2026-10-06CVE-2026-102407: Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by…
PriorityP432medium5.4CVSS 3.1
AVNACLPRLUINSUCNILAL
EPSS
0.22%
11.3th percentile
Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data stream to which they were not otherwise authorized, potentially injecting data into it or affecting its ability to be searched normally. This issue does not allow an attacker to read the contents of a data stream they do not otherwise have access to.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | elasticsearch | 7.17.5 – 7.17.29 | — |
| elastic | elasticsearch | 8.2.2 – 8.19.18 | — |
| elastic | elasticsearch | 9.0.0 – 9.3.7 | — |
| elastic | elasticsearch | 9.4.0 – 9.4.3 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-102407 python-elasticsearch: elasticsearch: unauthorized data modification via Modify Data Streams API [epel-all]
bugzilla·2026-10-08·CVSS 5.4
CVE-2026-102407 [MEDIUM] CVE-2026-102407 python-elasticsearch: elasticsearch: unauthorized data modification via Modify Data Streams API [epel-all]
CVE-2026-102407 python-elasticsearch: elasticsearch: unauthorized data modification via Modify Data Streams API [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data stream to which they were not otherwise authorized, potentially injecting data into it or affecting its ability to be searched normally. This issue doe
Bugzilla
CVE-2026-102407 python-elasticsearch6: elasticsearch: unauthorized data modification via Modify Data Streams API [epel-all]
bugzilla·2026-10-08·CVSS 5.4
CVE-2026-102407 [MEDIUM] CVE-2026-102407 python-elasticsearch6: elasticsearch: unauthorized data modification via Modify Data Streams API [epel-all]
CVE-2026-102407 python-elasticsearch6: elasticsearch: unauthorized data modification via Modify Data Streams API [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data stream to which they were not otherwise authorized, potentially injecting data into it or affecting its ability to be searched normally. This issue do
Bugzilla
CVE-2026-102407 python-elasticsearch: elasticsearch: unauthorized data modification via Modify Data Streams API [fedora-all]
bugzilla·2026-10-08·CVSS 5.4
CVE-2026-102407 [MEDIUM] CVE-2026-102407 python-elasticsearch: elasticsearch: unauthorized data modification via Modify Data Streams API [fedora-all]
CVE-2026-102407 python-elasticsearch: elasticsearch: unauthorized data modification via Modify Data Streams API [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data stream to which they were not otherwise authorized, potentially injecting data into it or affecting its ability to be searched normally. This issue d
Bugzilla
CVE-2026-102407 elasticsearch: elasticsearch: unauthorized data modification via Modify Data Streams API
bugzilla·2026-10-06·CVSS 5.4
CVE-2026-102407 [MEDIUM] CVE-2026-102407 elasticsearch: elasticsearch: unauthorized data modification via Modify Data Streams API
CVE-2026-102407 elasticsearch: elasticsearch: unauthorized data modification via Modify Data Streams API
Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data stream to which they were not otherwise authorized, potentially injecting data into it or affecting its ability to be searched normally. This issue does not allow an attacker to read the contents of a data stream they do not otherwise have access to.
2026-10-06
Published