Search Guard FLX versions 3.0.0 through 4.0.1 lack proper privilege checks for certain data-stream management operations. This weakness allows a user without the required permissions to execute these operations, potentially altering data-stream configurations and exposing confidential information. The flaw arises from missing or incorrect authorization controls (CWE‑285) and improper role-based access control (CWE‑862).

This vulnerability affects the Floragunn Search Guard FLX product in releases from 3.0.0 up to and including 4.0.1. Administrators should confirm whether their deployments run one of these impacted versions.

The CVSS base score is 6.8, indicating moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting limited publicly known exploitation. The likely attack vector would involve sending management requests through exposed cluster‑management APIs or command interfaces that are reachable over the network. An attacker needs only network access to those endpoints and authentication to the cluster; if the credentials lack the required privileges, the service still performs the requested operation.