Elasticsearch can unintentionally leak sensitive information through its query cache. When a privileged user performs a search, the result is cached on a shard and later accessed by a restricted user who has field‑level security restrictions. The cached data allows the restricted user to discover that certain documents match a query even though they cannot read the documents themselves. The same caching flaw can also cause a privileged user to receive incomplete results for queries that ran earlier by another user. This flaw is a classic example of Information Disclosure via improper cache usage.

Any installation of Elastic's Elasticsearch product that utilizes query caching and field‑level security is susceptible to this vulnerability. The specific versions affected are not listed in the advisory, so all current releases prior to the security update should be considered at risk.

The CVSS score of 4.2 reflects a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that a user with full privileges execute the same query on the same shard before a restricted user issues a similar request. This suggests that the attacker must be an internal user or have obtained privileged credentials. Once the conditions are met, the attacker can infer restricted data or influence the result sets returned to privileged users. Given the moderate CVSS score and no publicly known exploits, the risk is present but likely limited to environments where privileged and restricted users share the same cluster instances.