CVE-2025-13653CWE-200CWE-863broken-access-controlinformation-disclosure

CVE-2025-13653

Medium · published December 1, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
9.3
In the wild
Unconfirmed
What it is

In Search Guard FLX versions from 3.1.0 up to 4.0.0 with enterprise modules being disabled, there exists an issue which allows authenticated users to use specially crafted requests to read documents from data streams without having the respective privileges.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00200 · 9.3th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-863 · Incorrect Authorization
Published
2025-12-01T23:16Z
References (2)
https://docs.search-guard.com/latest/changelog-searchguard-flx-4_0_1 · [email protected]https://search-guard.com/cve-advisory/ · [email protected]
EPSS history
Timeline
  • 01 DEC 18:02Z
    Unauthorized access to documents in data streams with specially crafted requests
    cvelistv5