CVE-2026-115706
MEDIUM
MEDIUM
Priority: 0.00
BB Relevance:
44/100
Published: 2026-10-29
Modified: 2026-10-29
First seen: 2026-10-29
Status: active
Attack Surface
Adjacent
Low Complexity
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Adjacent
AC:
Low
PR:
High
UI:
None
S:
Unchanged
C:
High
I:
High
A:
High
Description
Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who controls any host in an ECE installation can obtain credentials that are reserved for other platform roles. These credentials can give the attacker full control of the ECE control plane and of the deployments that it manages.
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| Elastic | Elastic Cloud Enterprise | 1.0.0 |