What’s Vulnerable › Vulnerabilities

CVE-2025-13653: Unauthorized access to documents in data streams with specially crafted requests

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-01 · updated 2026-10-18
• Weakness: CWE-200

Description

In Search Guard FLX versions from 3.1.0 up to 4.0.0 with enterprise modules being disabled, there exists an issue which allows authenticated users to use specially crafted requests to read documents from data streams without having the respective privileges.

Affected products

• floragunn Search Guard FLX: from 3.1.0 through 4.0.0

References

• https://docs.search-guard.com/latest/changelog-searchguard-flx-4_0_1
• https://search-guard.com/cve-advisory/

Get alerted when CVE-2025-13653 or the next vulnerability affects your stack