CVE-2026-103007— Incorrect Authorization in Elasticsearch Leading to Privilege Escalation
Quick assessment
Affected
Elastic Elasticsearch
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Elasticsearch 中的错误授权（CWE-863）可能导致通过代理管理员特权实现的权限提升。该特权的范围在授权检查过程中未得到完全执行。Elasticsearch 中存在一个配置化的、非默认的特权，允许管理员将有限的角色管理能力委托给另一个用户，且该能力的作用范围限定为特定的索引。然而，执行此范围限制的授权检查未能正确考虑某些角色定义设置，这些设置可以扩大匹配的索引集合。拥有此代理特权且使用广泛匹配的索引模式的用户，可以通过更新自己分配的角色来利用这一不一致性，从而访问本应受限制的索引，包括内部安全数据。这
Possible ATT&CK Techniques 3 AI
T1548.002 · Bypass User Account Control T1068 · Exploitation for Privilege Escalation T1078.004 · Cloud AccountsAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Elastic | Elasticsearch | 8.16.0≤ 8.19.21 |
affected |
9.0.0≤ 9.4.6 |
affected | ||
9.5.0≤ 9.5.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-103007
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Incorrect Authorization in Elasticsearch Leading to Privilege Escalation
Source: CVE Program / CVE List V5
Vulnerability Description
Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator delegate limited role-management capability to another user, scoped to specific indices. The authorization check that enforces this scoping does not correctly account for a role-definition setting that can expand the matched index set. A user holding this delegated privilege with a broadly-scoped index pattern can exploit this inconsistency by updating their own assigned role to gain access to indices that should remain restricted, including internal security data. This can enable further escalation up to full administrative control of the cluster.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Elastic | Elasticsearch | 8.16.0 ~ 8.19.21 | - |
|
II. Public POCs for CVE-2026-103007
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-103007
请登录查看更多情报信息。
Other References for CVE-2026-103007 (1)
Same Patch Batch · Elastic · 2026-10-06 · 14 CVEs total
| CVE-2026-102406 | 8.8 HIGH | Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data In |
| CVE-2026-103009 | 7.1 HIGH | Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information D |
| CVE-2026-102412 | 6.5 MEDIUM | Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure |
| CVE-2026-102409 | 6.5 MEDIUM | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service |
| CVE-2026-102411 | 6.5 MEDIUM | Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of |
| CVE-2026-102404 | 6.5 MEDIUM | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service |
| CVE-2026-103008 | 6.5 MEDIUM | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service |
| CVE-2026-103005 | 6.5 MEDIUM | Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service |
| CVE-2026-103006 | 6.5 MEDIUM | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service |
| CVE-2026-102413 | 6.2 MEDIUM | Uncaught Exception in Elastic Endpoint Leading to Denial of Service |
| CVE-2026-102407 | 5.4 MEDIUM | Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification |
| CVE-2026-102410 | 4.3 MEDIUM | Missing Authorization in Kibana Leading to Information Disclosure |
| CVE-2026-102408 | 4.3 MEDIUM | Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service |
IV. Related Vulnerabilities
Same product: Elasticsearch
-
CVE-2026-103009
Authorization Bypass Through User-Controlled Key in Elastics -
CVE-2026-103008
Uncontrolled Recursion in Elasticsearch Leading to Denial of -
CVE-2026-103006
Uncontrolled Recursion in Elasticsearch Leading to Denial of -
CVE-2026-103005
Memory Allocation with Excessive Size Value in Elasticsearch -
CVE-2026-102411
Allocation of Resources Without Limits or Throttling in Elas
Same vendor: Elastic
-
CVE-2026-103009
Authorization Bypass Through User-Controlled Key in Elastics -
CVE-2026-103008
Uncontrolled Recursion in Elasticsearch Leading to Denial of -
CVE-2026-103006
Uncontrolled Recursion in Elasticsearch Leading to Denial of -
CVE-2026-103005
Memory Allocation with Excessive Size Value in Elasticsearch -
CVE-2026-102413
Uncaught Exception in Elastic Endpoint Leading to Denial of
Same weakness: CWE-863
-
CVE-2026-106463
Backstage: Improper authorization in GitLab organizational u -
CVE-2026-106461
Backstage: Incorrect authorization in scaffolder task listin -
CVE-2026-106458
Backstage: Inconsistent repository filtering in Bitbucket Se -
CVE-2026-106456
Backstage: Inconsistent credential enforcement for overlappi -
CVE-2026-102412
Incorrect Authorization in Kibana Leading to Sensitive Infor
V. Comments for CVE-2026-103007
No comments yet