1. Home
  2. CVE Database
  3. CVE-2026-115706
MEDIUM · 6.8

CVE-2026-115706

Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who controls any host in an E...

Vulnerability Description

Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who controls any host in an ECE installation can obtain credentials that are reserved for other platform roles. These credentials can give the attacker full control of the ECE control plane and of the deployments that it manages.

CVSS Score

6.8

MEDIUM

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
ElasticElastic Cloud Enterprise< 3.8.6

Related Weaknesses (CWE)

CWE-639

References

FAQ

What is CVE-2026-115706?

CVE-2026-115706 is a vulnerability with a CVSS score of 6.8 (MEDIUM). Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who controls any host in an E...

How severe is CVE-2026-115706?

CVE-2026-115706 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-115706?

Check the references section above for vendor advisories and patch information. Affected products include: Elastic Elastic Cloud Enterprise.