CVE-2026-4818: falha de média gravidade em floragunn Search Guard FLX
Some management operations on data streams are not properly restricted when user does not have the necessary privileges
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.8epss 0.2%
In Search Guard FLX versions from 3.0.0 up to 4.0.1, there exists an issue which allows users without the necessary privileges to execute some management operations against data streams.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
floragunn · Search Guard FLXCVEs relacionadas — floragunn Search Guard FLX
No mesmo produto, das mais perigosas para as menos.
CVE-2025-12149MEDIUMUnauthorized access to documents protected by Document-Level Security (DLS), when Signals watches include a search query involving protected documentsEPSS 0.3%CVE-2025-12148MEDIUMUnauthorized access to fields protected by Field Masking (FM) for fields of type IPEPSS 0.3%CVE-2025-12147MEDIUMUnauthorized access to fields protected by Field-Level Security (FLS) when those fields are members of an objectEPSS 0.3%CVE-2026-4819MEDIUMSearch Guard audit logs can contain under certain conditions user credentialsEPSS 0.2%CVE-2025-13653MEDIUMUnauthorized access to documents in data streams with specially crafted requestsEPSS 0.2%CVE-2026-4799MEDIUMOpen redirect vulnerability in Search Guard Kibana Plugin via manipulated requestsEPSS 0.2%