CVE-2026-103007

score

0.5

cvss

7.2

epss

0.3%

published

2026-10-06

kev added

—

first seen

2026-10-21

Elasticsearch contains an incorrect authorization vulnerability caused by improper enforcement of delegated administrative privilege scope during authorization checks, letting delegated users escalate privileges to access restricted indices, exploit requires delegated role-management privilege.