Vulnerability · Published Oct 29, 2026 · Assigned by elastic
CVE-2026-115712Incorrect Authorization in Elastic Cloud Enterprise (ECE) Leading to Unauthorized Modification of Platform Settings
Medium 4.3
In plain English
A medium-severity incorrect authorization in Elastic Cloud Enterprise from Elastic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Official description
Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of platform-level settings via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read-only access to the platform can change an installation-wide account setting that only platform administrators are permitted to change.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Elastic | Elastic Cloud Enterprise | 3.8.0 – through 3.8.54.0.0 – through 4.2.0 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N