CVE-2026-103007
published 2026-10-06CVE-2026-103007: Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced…
PriorityP347high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
0.34%
26.2th percentile
Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator delegate limited role-management capability to another user, scoped to specific indices. The authorization check that enforces this scoping does not correctly account for a role-definition setting that can expand the matched index set. A user holding this delegated privilege with a broadly-scoped index pattern can exploit this inconsistency by updating their own assigned role to gain access to indices that should remain restricted, including internal security data. This can enable further escalation up to full administrative control of the cluster.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | elasticsearch | >= 8.16.0 < 8.19.22 | 8.19.22 |
| elastic | elasticsearch | 8.16.0 – 8.19.21 | — |
| elastic | elasticsearch | >= 9.0.0 < 9.4.7 | 9.4.7 |
| elastic | elasticsearch | 9.0.0 – 9.4.6 | — |
| elastic | elasticsearch | >= 9.5.0 < 9.5.4 | 9.5.4 |
| elastic | elasticsearch | 9.5.0 – 9.5.3 | — |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
elasticsearch: Elasticsearch: Privilege escalation via improper enforcement of delegated role permissions
vendor_redhat·2026-10-06·CVSS 7.2
CVE-2026-103007 [HIGH] CWE-266 elasticsearch: Elasticsearch: Privilege escalation via improper enforcement of delegated role permissions
elasticsearch: Elasticsearch: Privilege escalation via improper enforcement of delegated role permissions
Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator delegate limited role-management capability to another user, scoped to specific indices. The authorization check that enforces this scoping does not correctly account for a role-definition setting that can expand the matched index set. A user holding this delegated privilege with a broadly-scoped index pattern can exploit this inconsistency by updating their own assigned role
GHSA
Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks.
ghsa_unreviewed·2026-10-06
CVE-2026-103007 [HIGH] CWE-863 Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks.
Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator delegate limited role-management capability to another user, scoped to specific indices. The authorization check that enforces this scoping does not correctly account for a role-definition setting that can expand the matched index set. A user holding this delegated privilege with a broadly-scoped index pattern can exploit this inconsistency by updating their own assigned role to gain access to indices that should remain restricted, including internal security data. This can enable
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-103007 python-elasticsearch: Elasticsearch: Privilege escalation via improper enforcement of delegated role permissions [fedora-all]
bugzilla·2026-10-21·CVSS 7.2
CVE-2026-103007 [HIGH] CVE-2026-103007 python-elasticsearch: Elasticsearch: Privilege escalation via improper enforcement of delegated role permissions [fedora-all]
CVE-2026-103007 python-elasticsearch: Elasticsearch: Privilege escalation via improper enforcement of delegated role permissions [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator delegate limited role-management capability to another user, scoped to specific indices. The authorization check that
Bugzilla
CVE-2026-103007 python-elasticsearch: Elasticsearch: Privilege escalation via improper enforcement of delegated role permissions [epel-all]
bugzilla·2026-10-21·CVSS 7.2
CVE-2026-103007 [HIGH] CVE-2026-103007 python-elasticsearch: Elasticsearch: Privilege escalation via improper enforcement of delegated role permissions [epel-all]
CVE-2026-103007 python-elasticsearch: Elasticsearch: Privilege escalation via improper enforcement of delegated role permissions [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator delegate limited role-management capability to another user, scoped to specific indices. The authorization check that e
Bugzilla
CVE-2026-103007 elasticsearch: Elasticsearch: Privilege escalation via improper enforcement of delegated role permissions
bugzilla·2026-10-06·CVSS 7.2
CVE-2026-103007 [HIGH] CVE-2026-103007 elasticsearch: Elasticsearch: Privilege escalation via improper enforcement of delegated role permissions
CVE-2026-103007 elasticsearch: Elasticsearch: Privilege escalation via improper enforcement of delegated role permissions
Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator delegate limited role-management capability to another user, scoped to specific indices. The authorization check that enforces this scoping does not correctly account for a role-definition setting that can expand the matched index set. A user holding this delegated privilege with a broadly-scoped index pattern can exploit this inconsistency by updating their o
2026-10-06
Published