Search Guard FLX CVE-2025-12147

Exploitation requires: (1) an authenticated account with search access (PR:L); (2) an index where Field-Level Security exclusion rules (~field syntax) are applied specifically to object-valued fields; and (3) the attacker crafting and iterating search queries against the object's child attributes to infer values (AT:P). It does NOT work where FLS is unused, where excluded fields are scalar rather than objects, or where the documented workaround (adding a child-member exclusion like ~object.*) has been applied. Limited to Search Guard FLX 3.1.1 and earlier; fixed in 3.1.2. The gating authentication and the need for query-based inference substantially limit practical mass exploitation.

This is a genuine but moderate-severity information-disclosure flaw, not a high-urgency issue. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H) scores 6.0 (Medium): network-reachable but requiring an authenticated low-privilege account (PR:L) and an attack requirement (AT:P) because the adversary must craft iterative search queries to probe/infer the hidden object members rather than reading them directly. All signals point to low real-world urgency: EPSS is 0.27% (18th percentile), there is no CISA KEV listing, and no public exploit code was identified. The impact is confidentiality-only (VI:N/VA:N) and bounded to fields that administrators specifically chose to protect with FLS exclusion rules, so exposure depends entirely on how FLS is configured. No signals conflict here - low EPSS, absence of KEV, and the authenticated/attack-requirement gating all agree this is a configuration-dependent inference weakness, prioritize via patch cycle rather than emergency response.

An authenticated user who is restricted by a Field-Level Security exclusion rule on an object-valued field (e.g. ~profile) finds that although the object is stripped from _source, its child attributes (profile.ssn, profile.salary) remain queryable. By issuing targeted search/term queries against those child fields and observing hit/no-hit responses, the attacker infers or reconstructs the protected values. No public exploit code exists, but the technique requires only ordinary search-query access and basic knowledge of the object's schema.