Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification

Description

Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data stream to which they were not otherwise authorized, potentially injecting data into it or affecting its ability to be searched normally. This issue does not allow an attacker to read the contents of a data stream they do not otherwise have access to.

Scores

EPSS (exploitation in 30 days)

0.22% · top 88% of all CVEs (4 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.4.

Weakness

• CWE-863 Incorrect Authorization (opens in a new tab)All about CWE-863 and its CVEs

Affected products

• Elastic · Elasticsearch

  • affected 7.17.5 – ≤ 7.17.29
  • affected 8.2.2 – ≤ 8.19.18
  • affected 9.0.0 – ≤ 9.3.7
  • affected 9.4.0 – ≤ 9.4.3

References (1)

• https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-188/390861 (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-102407](https://trackcve.app/badge/CVE-2026-102407.svg)](https://trackcve.app/cve/CVE-2026-102407)

Record last updated 6 Oct 2026, 19:56 UTC.