Vulnerability · Published Dec 1, 2025 · Assigned by floragunn
CVE-2025-13653Unauthorized access to documents in data streams with specially crafted requests
Medium 4.3
In plain English
A medium-severity information exposure in Search Guard FLX from floragunn. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.2%top 88.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In Search Guard FLX versions from 3.1.0 up to 4.0.0 with enterprise modules being disabled, there exists an issue which allows authenticated users to use specially crafted requests to read documents from data streams without having the respective privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| floragunn | Search Guard FLX | 3.1.0 – through 4.0.0 |
Weakness: CWE-200, CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N