CVE-2021-22149

8.8 highEPSS 0.8%

High (8.8) in elastic enterprise search. EPSS 0.8% chance of exploitation in the next 30 days.

Elastic Enterprise Search App Search versions before 7.14.0 are vulnerable to an issue where API keys were missing authorization via an alternate route. Using this vulnerability, an authenticated attacker could utilize API keys belonging to higher privileged users.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 57% of CVEs (scores of 2026-10-31)
CWEs: CWE-862, CWE-732
Published: 2021-09-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

elastic:enterprise_search

References

https://discuss.elastic.co/t/elastic-stack-7-14-0-security-update/280344
https://www.elastic.co/community/security/
https://discuss.elastic.co/t/elastic-stack-7-14-0-security-update/280344
https://www.elastic.co/community/security/

Check your stack JSON