Elastic Cloud Enterprise EUVD-2026-112924

Requires a valid, already-authenticated Elastic Cloud Enterprise account holding read-only platform access (PR:L) that is network-reachable to the ECE management interface; no victim user interaction is needed (UI:N). Exploitation is limited to changing a single installation-wide account setting normally restricted to platform administrators - impact is integrity-only (I:L), with no confidentiality or availability consequences stated. The principal limiting factor is the need for an existing low-privileged platform account, so exposure is bounded to users who already have some authorized access to the ECE platform; the exact setting and trigger mechanism are not described in the available sources.

This is a medium-severity authorization flaw (CVSS 4.3) that signals indicate is a routine, schedule-driven patch rather than an emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) shows network-reachable, low-complexity exploitation but requires an already-authenticated low-privileged account (PR:L), and the only impact is a limited integrity effect (I:L) - no confidentiality or availability impact. The vuln.today decision label is 'this_month', consistent with a moderate, non-urgent priority. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no evidence of active exploitation or an available exploit. The practical risk is a privilege/authorization boundary violation: a read-only platform user can alter an installation-wide setting reserved for platform administrators, which is a governance and integrity concern rather than a data-breach or service-outage risk. EPSS is simply absent (not low) here, so exploitation probability cannot be quantified from the data; the main signal of real-world importance is the vendor (Elastic) self-reporting and shipping fixed versions.

An attacker who already holds a legitimate read-only account on an Elastic Cloud Enterprise installation sends an authenticated request to modify an installation-wide account setting that should be restricted to platform administrators. Because the authorization check is incorrect, the change is accepted, letting a low-trust user alter platform-level configuration beyond their intended role. No public exploit code or PoC was identified in the available data, and no user interaction by a victim is required.