CVE-2025-13653

—

CVSS 3.1

4.3 medium

EPSS

<1%p10

Published

Dec 1, 2025 (Dec 1, 2025)

Modified

Jun 17, 2026

Description

In Search Guard FLX versions from 3.1.0 up to 4.0.0 with enterprise modules being disabled, there exists an issue which allows authenticated users to use specially crafted requests to read documents from data streams without having the respective privileges.

Weakness: CWE-200, CWE-863
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.