CVE-2025-12149CWE-200CWE-863broken-access-controlinformation-disclosure

CVE-2025-12149

published November 14, 2025

CVSS
6.0
EPSS
0%
Percentile
21.9
In the wild
Unconfirmed
What it is

In Search Guard FLX versions 3.1.2 and earlier, while Document-Level Security (DLS) is correctly enforced elsewhere, when the search is triggered from a Signals watch, the DLS rule is not enforced, allowing access to all documents in the queried indices.

The record
Technical detail
CVSS
6.0 · NONE
CVSS v4.0
Not supplied
EPSS
0.00303 · 21.9th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-863 · Incorrect Authorization
Published
2025-11-14T19:15Z
References (3)
https://docs.search-guard.com/latest/changelog-searchguard-flx-3_1_3 · [email protected]https://docs.search-guard.com/latest/changelog-searchguard-flx-4_0_0 · [email protected]https://search-guard.com/cve-advisory/ · [email protected]
EPSS history
Timeline
  • 14 NOV 13:58Z
    Unauthorized access to documents protected by Document-Level Security (DLS), when Signals watches include a search query involving protected documents
    cvelistv5