AZL-112649
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-112649.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-112649
- Upstream
- CVE-2026-115298
- Published
- 2026-11-03T17:17:55Z
- Modified
- 2026-11-04T14:17:26Z
- Summary
- CVE-2026-115298 affecting package rubygem-elasticsearch 8.9.0-1
- Details
-
Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user whose index access is restricted by field-level security can retrieve the value of a constant_keyword field that their role excludes. Some search and query features do not apply the field-level security restriction to this field type.
- References