Medium severity · published Oct 29, 2026
CVE-2026-115712
Incorrect Authorization in Elastic Cloud Enterprise (ECE) Leading to Unauthorized Modification of Platform Settings
New
4.3
CVSS
–
EPSS
No
On KEV
Description
Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of platform-level settings via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read-only access to the platform can change an installation-wide account setting that only platform administrators are permitted to change.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EC
Elastic Cloud Enterprise · Elastic
3.8.0 through 3.8.5; 4.0.0 through 4.2.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-115712
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-115712
discuss.elastic.co
https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-221/391265
More from Elastic Cloud Enterprise
9.8
CVE-2024-37282
It was identified that under certain specific preconditions, an API key that was originally created with a specific privileges could be subsequently used to create new API keys…
8.8
CVE-2025-37736
Elastic Cloud Enterprise Improper Authorization
8.2
CVE-2026-115709
Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Loss
7.5
CVE-2026-115713
Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Modification
7.5
CVE-2023-31418
An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer