A vulnerability in the OpenSearch Security plugin's document-level security (DLS) allows authenticated users to bypass DLS restrictions on documents linked by has_parent or has_child join relations. This affects clusters using both DLS and the join field type on the same index. The issue is fixed in OpenSearch versions 2.19.4 and 3.2.0.