Incorrect Authorization Affecting org.opensearch.plugin:opensearch-security package, versions [,2.19.4)[3.0.0.0,3.2.0.0)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-ORGOPENSEARCHPLUGIN-16799819
- published22 May 2026
- disclosed7 May 2026
- creditUnknown
Introduced: 7 May 2026
CVE NOT AVAILABLE CWE-863 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade org.opensearch.plugin:opensearch-security to version 2.19.4, 3.2.0.0 or higher.
Overview
Affected versions of this package are vulnerable to Incorrect Authorization in the processing of search queries involving has_parent or has_child join relations when document-level security is enabled. An attacker can gain unauthorized access to restricted document contents by crafting queries that exploit the improper enforcement of access controls on documents linked by parent/child relationships.