High severity8.1NVD Advisory· Published Mar 25, 2019· Updated Jun 17, 2026
CVE-2019-7611
CVE-2019-7611
Description
A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the _aliases, _shrink, or _split endpoints are used . If the elasticsearch.yml file has xpack.security.dls_fls.enabled set to false, certain permission checks are skipped when users perform one of the actions mentioned above, to make existing data available under a new index/alias name. This could result in an attacker gaining additional permissions against a restricted index.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.elasticsearch:elasticsearchMaven | < 5.6.15 | 5.6.15 |
org.elasticsearch:elasticsearchMaven | >= 6.0.0, < 6.6.1 | 6.6.1 |
Affected products
2- Range: before 5.6.15 and 6.6.1
Patches
Vulnerability mechanics
References
4- discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077nvdVendor AdvisoryWEB
- github.com/advisories/GHSA-fj32-6v7m-57pgghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2019-7611ghsaADVISORY
- www.elastic.co/community/securitynvdVendor AdvisoryWEB
News mentions
0No linked articles in our index yet.