## Elasticsearch 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-197)

- 種別: advisory
- 関連技術: elasticsearch
- 公開日時: 2026-10-06T18:51:14.000Z
- 情報源: Elastic Security Announcements (https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-197/390871)
- パーマリンク: https://vulnpulse.app/items/elastic-security-4ccc2fdb210e

Incorrect Authorization in Elasticsearch Leading to Privilege Escalation Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator delegate limited role-management capability to another user, scoped to specific indices. The authorization check that enforces this scoping does not correctly account for a role-definition setting that can expan…