Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of platform-level settings via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read-only access to the platform can change an installation-wide account setting that only platform administrators are permitted to change.

Improper Authorization in Elastic Cloud Enterprise can lead to Privilege Escalation where the built-in readonly user can call APIs that should not be allowed. The list of APIs that are affected by this issue is:

post:/platform/configuration/security/service-accounts delete:/platform/configuration/security/service-accounts/{userid} patch:/platform/configuration/security/service-accounts/{userid} post:/platform/configuration/security/service-accounts/{userid}/keys delete:/platform/configuration/security/service-accounts/{userid}/keys/{apikeyid} patch:/user post:/users post:/users/auth/keys delete:/users/auth/keys delete:/users/auth/keys/all delete:/users/auth/keys/{apikeyid} delete:/users/{userid}/auth/keys delete:/users/{userid}/auth/keys/{apikeyid} delete:/users/{username} patch:/users/{username}