CVE-2026-115712
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) allows an authenticated user with read-only access to change an installation-wide account setting that only platform administrators should be permitted to change.
Risk Assessment
A low-privileged user can alter critical platform settings, potentially leading to unauthorized configuration changes and weakening the security of the entire ECE installation.
Recommendation
Update Elastic Cloud Enterprise to a version containing the fix and verify that read-only users cannot modify platform-level settings.
Other vulnerabilities in Elastic Cloud Enterprise
See all- CVE-2025-37729Critical
Improper neutralization of special elements in the template engine of Elastic Cloud Enterprise (ECE) allows an admin-level actor to exfiltrate sensitive information and issue commands via a specially crafted string where Jinjava variables are evaluated.
- CVE-2026-115713High
Improper Link Resolution Before File Access (CWE-59) in Elastic Cloud Enterprise (ECE) allows a symlink attack (CAPEC-132). This can lead to unauthorized read and write access to data of other deployments on the same host.
- CVE-2026-115711Medium
Insertion of Sensitive Information into an Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to credential disclosure. ECE stores runtime information about platform service containers in a location readable by lower-privileged components, and this data includes secrets from container configuration, including role tokens.
- CVE-2026-115709High
Improper Link Resolution Before File Access (CWE-59) in Elastic Cloud Enterprise (ECE) allows a symlink attack (CAPEC-132). This can lead to unauthorized disclosure and loss of data belonging to other deployments on the same host.
- CVE-2026-115708High
Improper Link Resolution Before File Access (CWE-59) in Elastic Cloud Enterprise (ECE) allows a symlink attack (CAPEC-132). This can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host.
- CVE-2026-115707Medium
Insertion of Sensitive Information into an Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation. After the ECE certificate rotation procedure runs, retained data contains platform credentials and certificate authority private keys readable by lower-privileged components.
- CVE-2026-115706Medium
Authorization Bypass Through a User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation. An attacker who controls any host in an ECE installation can obtain credentials reserved for other platform roles.
- CVE-2025-37736High
Improper Authorization in Elastic Cloud Enterprise can lead to Privilege Escalation where the built-in readonly user can call APIs that should not be allowed. The affected APIs include operations on service accounts, users, and API keys.
Original NVD description (English source)
Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of platform-level settings via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read-only access to the platform can change an installation-wide account setting that only platform administrators are permitted to change.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS