Improper privilege management in Elastic Enterprise Search
Priority MEDIUM 40CWE-266Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-266.
Summary
Elastic Enterprise Search before 7.9.0 contain a credential exposure flaw in the App Search interface. If a user is given the �developer� role, they will be able to view the administrator API credentials. These credentials could allow the developer user to conduct operations with the same permissions of the App Search administrator.
Why it matters now
EPSS 0.0109 65th percentileScored 2026-11-07
Fix Fixed Elastic Enterprise Search (Elastic): 7.9.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
- Fix · CNA Elastic Enterprise Search (Elastic) Fixed in 7.9.0
Timeline
- 2026-10-02 Threatist record created from CVE-2020-7018
- 2026-10-03 Alias added: GHSA-hq5w-vrxc-xx2g
References
More Elastic Enterprise Search vulnerabilities
- TI-2021-05139 Incorrect permission assignment in Elastic Enterprise Search CVSS 3.1HIGH 8.8
- TI-2021-05138 Incorrect permission assignment in Elastic Enterprise Search CVSS 3.1HIGH 8.8
- TI-2023-27293 Enterprise Search Insertion of Sensitive Information into Log File CVSS 3.1MEDIUM 6.8
- TI-2021-15698 Server-side request forgery in Elastic Enterprisesearch CVSS 3.1MEDIUM 6.8
Sources
- CVE-2020-7018 · CVE Program
- CVE-2020-7018 · NVD
- FIRST EPSS
- GHSA-hq5w-vrxc-xx2g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences