The flaw in Search Guard FLX permits users who lack the necessary permissions to execute certain management operations on data streams. This lapse in access control enables unauthorized modification or deletion of data streams, potentially compromising data integrity and availability. The weakness maps to Access Control failures (CWE-285) and Illegal Privilege Escalation (CWE-862).

Search Guard FLX, developed by Floragunn, is affected for all releases between version 3.0.0 and 4.0.1 inclusive. Anyone running those versions on their Elasticsearch cluster is susceptible to the vulnerability if user privileges are not correctly enforced.

The CVSS base score of 6.8 indicates a moderate threat level, and the EPSS value below 1% suggests that exploitation is currently uncommon. The vulnerability is not recorded in the CISA KEV catalog. Attack attempts would likely target the cluster’s internal API or management interfaces, as privileged operations are performed via Search Guard’s authentication mechanism. Because the exploit requires only the existence of an account lacking proper rights, it can be carried out by an attacker who gains minimal access within the environment; however, a dedicated exploit is not documented in the supplied information, so the likelihood remains low based on current evidence.