CVE-2026-4818CWE-285CWE-862

Some management operations on data streams are not properly restricted when user does not have the necessary privileges

Medium · published March 31, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
24.8
In the wild
Unconfirmed
What it is

In Search Guard FLX versions from 3.0.0 up to 4.0.1, there exists an issue which allows users without the necessary privileges to execute some management operations against data streams.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00329 · 24.8th percentile
Weaknesses
CWE-285 · Improper Authorization; CWE-862 · Missing Authorization
Published
2026-03-31T14:53Z
EPSS history
Timeline
  • 31 MAR 14:53Z
    Some management operations on data streams are not properly restricted when user does not have the necessary privileges
    cvelistv5