CVE-2024-12539: Elasticsearch Incorrect Authorization vulnerability

December 17, 2024 (updated October 31, 2025)

An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security in Elasticsearch and get access to documents that their roles would normally not allow.

References

discuss.elastic.co/t/elasticsearch-8-16-2-8-17-0-security-update/372091
github.com/advisories/GHSA-5mpw-4546-2wcr
github.com/elastic/elasticsearch
nvd.nist.gov/vuln/detail/CVE-2024-12539

Code Behaviors & Features

Detect and mitigate CVE-2024-12539 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →