CVE-2026-4818

In Search Guard FLX versions from 3.0.0 up to 4.0.1, there exists an issue which allows users without the necessary privileges to execute some management operations against data streams.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://docs.search-guard.com/latest/changelog-searchguard-flx-4_1_0	Release Notes
https://search-guard.com/cve-advisory/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:search-guard:flx:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-31 16:16

Updated : 2026-07-24 20:10

NVD link : CVE-2026-4818

Mitre link : CVE-2026-4818

CVE.ORG link : CVE-2026-4818

JSON object : View

Products Affected

search-guard

flx

CWE

CWE-285

Improper Authorization

CWE-862

Missing Authorization

{"id": "CVE-2026-4818", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4818", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-03-31T17:23:12.638976Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@search-guard.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@search-guard.com", "affectedData": [{"vendor": "floragunn", "product": "Search Guard FLX", "versions": [{"status": "affected", "version": "3.0.0", "versionType": "semver", "lessThanOrEqual": "4.0.1"}], "defaultStatus": "unaffected"}]}], "published": "2026-03-31T16:16:34.580", "references": [{"url": "https://docs.search-guard.com/latest/changelog-searchguard-flx-4_1_0", "tags": ["Release Notes"], "source": "security@search-guard.com"}, {"url": "https://search-guard.com/cve-advisory/", "tags": ["Vendor Advisory"], "source": "security@search-guard.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@search-guard.com", "description": [{"lang": "en", "value": "CWE-285"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "In Search Guard FLX versions from 3.0.0 up to 4.0.1, there exists an issue which allows users without the necessary privileges to execute some management operations against data streams."}, {"lang": "es", "value": "En las versiones de Search Guard FLX desde la 3.0.0 hasta la 4.0.1, existe un problema que permite a usuarios sin los privilegios necesarios ejecutar algunas operaciones de gesti\u00f3n contra flujos de datos."}], "lastModified": "2026-07-24T20:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:search-guard:flx:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0EB4FA3B-8F81-4678-AA9B-8CEFA348E652", "versionEndExcluding": "4.1.0", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@search-guard.com"}