Live › vulnerability › CVE-2026-115712
Elastic Cloud Enterprise has an authorization flaw that lets a user with read-only platform access change an installation-wide account setting. Only platform administrators should be able to change that setting, so a read-only account can alter settings meant for administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 15:25 UTC. All times on this page are UTC.
Organizations running self-managed Elastic Cloud Enterprise platforms where some users hold read-only access. Installations where every account has administrator rights, or that do not run ECE, are not exposed through this flaw. The sources do not list affected or fixed versions.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of platform-level settings via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read-only access to the platform can change an installation-wide account setting that only platform administrators are permitted to change.
This page as .md · .json · in your agent: get_signal("CVE-2026-115712")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.