Read the docs
TI-2021-05139 Aliases CVE-2021-22149GHSA-fq33-497v-4h5x

Incorrect permission assignment in Elastic Enterprise Search

Priority MEDIUM 40CWE-732Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.

Summary

Elastic Enterprise Search App Search versions before 7.14.0 are vulnerable to an issue where API keys were missing authorization via an alternate route. Using this vulnerability, an authenticated attacker could utilize API keys belonging to higher privileged users.

Why it matters now

EPSS 0.00828 57th percentileScored 2026-11-07
Fix Fixed Elastic Enterprise Search (Elastic): 7.14.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ElasticElastic Enterprise Searchbefore 7.14.07.14.0Patch availableCNA
  • Elastic Enterprise Search VendorElastic Affected before 7.14.0 Fixed in 7.14.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:elastic:enterprise_search:*:*:*:*:*:*:*:*before 7.14.0VulnerableElastic
  • cpe:2.3:a:elastic:enterprise_search:*:*:*:*:*:*:*:* Versions before 7.14.0 Vulnerable ·Elastic

Remediation

  • Fix · CNA Elastic Enterprise Search (Elastic) Fixed in 7.14.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-22149
  2. 2026-10-03 Alias added: GHSA-fq33-497v-4h5x

References

Advisory 2

  • TI-2021-05138 Incorrect permission assignment in Elastic Enterprise Search CVSS 3.1HIGH 8.8
  • TI-2020-05666 Improper privilege management in Elastic Enterprise Search CVSS 3.1HIGH 8.8
  • TI-2023-27293 Enterprise Search Insertion of Sensitive Information into Log File CVSS 3.1MEDIUM 6.8
  • TI-2021-15698 Server-side request forgery in Elastic Enterprisesearch CVSS 3.1MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences