Cloudanix VulnDB

GHSA-x83w-23jp-g6pw

Medium · 5.3

OpenSearch Security plugin: DLS not applied on documents linked by has_child or has_parent relation

CVSS

5.3

EPSS

—

Published

May 7, 2026

CISA due date

—

The record

A flaw was identified in the OpenSearch Security plugin's document-level security (DLS) implementation. DLS restrictions were not correctly applied to search queries that use has_parent or has_child join relations. This could allow an authenticated user to access document contents that should have been restricted by DLS rules.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities