A vulnerability in Elasticsearch allows an authenticated user with restricted index access to retrieve values from constant_keyword fields that their role should exclude. This occurs because some search and query features do not enforce field-level security restrictions on this field type, leading to potential information disclosure.