Skip to content
CVE PROGRAM SOURCE RECORD7.2 High

CVE-2026-115708

Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Authentication Bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
elastic

Description

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host via Symlink Attack (CAPEC-132).

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Elastic Elastic Cloud Enterprise

Default version status: unaffected

  • 1.0.0 to ≤ 3.8.5affected
  • 4.0.0 to ≤ 4.2.0affected

References