A vulnerability in the OpenSearch Security plugin allows improper authorization checks during index rollover requests. Specifically, when a rollover request specifies an explicit target index name, the plugin fails to properly verify access permissions for the target index. This flaw enables users with rollover permissions on a source index to create new indices with unauthorized names. The issue affects OpenSearch versions prior to 2.19.4.0 and 3.2.0.0 and has a low severity rating. Fixed versions are available.