Search Guard FLX Document Access Control Bypass Vulnerability

A vulnerability exists in Search Guard FLX versions 3.1.0 prior to 4.0.0, when enterprise modules are disabled. It allows authenticated users to craft requests that bypass access controls on data streams, enabling them to read documents without the necessary privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized access to documents in data streams, bypassing established access controls.

Remediation

Users can upgrade to Search Guard FLX version 4.0.1, which addresses this vulnerability. Before upgrading, it is recommended to review the use of selector-based queries and data streams to ensure proper access control, and to validate these changes in a non-production environment.