Vulnerability · Published Oct 29, 2025 · Assigned by floragunn
CVE-2025-12147Unauthorized access to fields protected by Field-Level Security (FLS) when those fields are members of an object
Medium 6.0
In plain English
A medium-severity information exposure in Search Guard FLX from floragunn. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).
Official description
In Search Guard FLX versions 3.1.1 and earlier, Field-Level Security (FLS) rules are improperly enforced on object-valued fields. When an FLS exclusion rule (e.g., ~field) is applied to a field which contains an object as its value, the object is correctly removed from the _source returned by search operations. However, the object members (i.e., child attributes) remain accessible to search queries. This exposure allows adversaries to infer or reconstruct the original contents of the excluded object. Workaround - If you cannot upgrade immediately and FLS exclusion rules are used for object valued attributes (like ~object), add an additional exclusion rule for the members of the object (like ~object.*).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| floragunn | Search Guard FLX | 1.0.0 – through 3.1.1 |
Weakness: CWE-200, CWE-732 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N