Incorrect Authorization (CWE‑863) in Elasticsearch allows an authenticated user with limited index privileges to trigger the ingest‑simulation feature on indices they are normally not allowed to read. When activated, the ingest pipelines configured for those indices are executed and the resulting output is returned to the attacker, exposing data that the pipelines have processed or enriched. The same exploitation path also returns index mapping metadata that the user would otherwise be unable to obtain, thereby leaking structural information about the data stored in those indices.

All installations of Elastic Elasticsearch that employ the ingest‑simulation feature are potentially vulnerable. The advisory does not specify a version range, so any deployment running Elasticsearch with this feature enabled should be considered susceptible until a vendor‑supplied fix is applied.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation at this time, and the vulnerability is not listed in CISA KEV. The exploit requires a legitimate cluster login; a user already authenticated with limited index privileges can pass the ingest‑simulation API a target index name they cannot normally read, causing the cluster to run that index’s pipeline and return the result. Thus, the attack vector is inferred to be remote authenticated users who possess basic cluster access.