CVE-2026-115712: Incorrect Authorization in Elastic Cloud Enterprise (ECE) Leading to Unauthorized Modification of Platform Settings
Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of platform-level settings via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read-only access to the platform can change an installation-wide account setting that only platform administrators are permitted to change.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated ECE user with read-only access to the platform can exploit it. The issue does not require platform-administrator privileges.
What level of access or interaction is required?
The attacker needs network access and valid authenticated read-only platform access. No user interaction is required.
What is the practical impact?
A successful attacker can modify an installation-wide account setting that should be restricted to platform administrators. The provided data identifies integrity impact only; it does not indicate confidentiality or availability impact.