{"id":"elastic-security-4ccc2fdb210e","seq":2804,"kind":"advisory","title":"Elasticsearch 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-197)","url":"https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-197/390871","permalink":"https://vulnpulse.app/items/elastic-security-4ccc2fdb210e","summary":"Incorrect Authorization in Elasticsearch Leading to Privilege Escalation Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator delegate limited role-management capability to another user, scoped to specific indices. The authorization check that enforces this scoping does not correctly account for a role-definition setting that can expan…","severity":null,"techs":["elasticsearch"],"cves":[],"tags":["security"],"source":{"id":"elastic-security","name":"Elastic Security Announcements"},"published_at":"2026-10-06T18:51:14.000Z","fetched_at":"2026-10-21T16:17:47.217Z"}