# CVE-2026-115712: Elastic Cloud Enterprise authorization bypass in platform settings

Source: https://junglewise.ai/threats/cve-2026-115712-incorrect-authorization-cwe-863-in-elastic-cloud-enterprise-ece  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-115712 · Severity: medium · CVSS 4.3 · Published 2026-10-29

Elastic Cloud Enterprise, a platform for managing cloud-based search and analytics infrastructure, contains an authorization flaw that allows read-only users to modify platform-wide settings meant only for administrators. An authenticated read-only user can exploit this to change installation-wide account settings, potentially affecting the security and configuration of the entire platform.

Technologies: [Elastic Cloud Enterprise](https://junglewise.ai/threats/technologies/elastic-cloud-enterprise). Vendors: [Elastic](https://junglewise.ai/threats/vendors/elastic).

## Quick answers

**Is CVE-2026-115712 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115712 being exploited in the wild.

**How severe is CVE-2026-115712?** Medium severity, with a CVSS score of 4.3, published 29 October 2026.

**Which products and versions are affected?** Elastic Cloud Enterprise 3.8.0 through 3.8.5, 4.0.0 through 4.2.0.

**Is there a fix for CVE-2026-115712?** Yes: fixed in 3.8.6, 4.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115712 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-115712?** Check whether you run Elastic Cloud Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.8.6, 4.2.1

## Technical details

An incorrect authorization check (CWE-863) in ECE fails to properly constrain ACLs on platform-level settings modification. An authenticated user with read-only permissions can access and modify installation-wide account settings restricted to platform administrators. The vulnerability requires network access and valid credentials but no additional user interaction; a fix is available in versions 3.8.6 and 4.2.1.

## Affected products

- Elastic Cloud Enterprise 3.8.0 through 3.8.5, 4.0.0 through 4.2.0

## Timeline

- 2026-10-29: disclosed

## References

- [https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-221/391265](https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-221/391265)

## Related threats

- [Elastic Cloud Enterprise symlink attack leads to data access](https://junglewise.ai/threats/cve-2026-115713-improper-link-resolution-before-file-access-link-following-cwe)
- [Elastic Cloud Enterprise credential exposure in container runtime data](https://junglewise.ai/threats/cve-2026-115711-insertion-of-sensitive-information-into-externally-accessible)
- [Elastic Cloud Enterprise symlink attack via improper link resolution](https://junglewise.ai/threats/cve-2026-115709-improper-link-resolution-before-file-access-link-following-cwe)
- [Elastic Cloud Enterprise symlink attack authentication bypass](https://junglewise.ai/threats/cve-2026-115708-improper-link-resolution-before-file-access-link-following-cwe)
- [Elastic Cloud Enterprise certificate rotation sensitive data exposure](https://junglewise.ai/threats/cve-2026-115707-insertion-of-sensitive-information-into-externally-accessible)