CVE-2026-102407: CWE-863 Incorrect Authorization in Elastic Elasticsearch

This vulnerability (CWE-863) in Elasticsearch involves improper enforcement of access control lists (ACLs) on the Modify Data Streams API. An authenticated user with limited privileges can exploit this flaw to modify or inject data into data streams outside their authorized scope. While the attacker cannot read unauthorized data, they can affect the integrity and availability of data streams by altering them. The issue affects Elasticsearch versions >=7.17.5 <=7.17.29, >=8.2.2 <=8.19.18, >=9.0.0 <=9.3.7, and >=9.4.0 <=9.4.3. No known exploits are reported in the wild, and no vendor patch links are provided in the input data.

An attacker with authenticated access and privileges on a single resource can modify data streams they should not have access to, potentially injecting unauthorized data or disrupting normal search operations. The vulnerability does not allow unauthorized data disclosure but can impact data integrity and availability within affected data streams.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided in the input data, users should monitor Elastic's advisories for updates. In the meantime, restrict authenticated user privileges to the minimum necessary to reduce risk.