The vulnerability is an incorrect authorization flaw that allows an authenticated user with restricted field-level access to retrieve the value of a constant_keyword field that their role would normally exclude. This leads to unauthorized disclosure of data that should be protected by role-based controls. The weakness is identified as CWE‑863.

Memory Elastic’s Elasticsearch product is impacted, with the current security update addressing versions 8.19.24 and 9.4.9/9.5.6 according to the vendor’s advisory. Specific version ranges beyond those releases are not explicitly listed in the input, so users of older or unpatched releases should verify their version against the update.

The CVSS score of 4.3 indicates moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation data. Inferred attack conditions require an authenticated user with index access and field‑level security enabled; the attacker can exploit the flaw to read restricted constant_keyword fields, potentially revealing sensitive configuration or data values. The risk is primarily confidentiality degradation rather than denial of service or remote code execution.