CVE-2025-12147 Details
Description
In Search Guard FLX versions 3.1.1 and earlier, Field-Level Security (FLS) rules are improperly enforced on object-valued fields. When an FLS exclusion rule (e.g., ~field) is applied to a field which contains an object as its value, the object is correctly removed from the _source returned by search operations. However, the object members (i.e., child attributes) remain accessible to search queries. This exposure allows adversaries to infer or reconstruct the original contents of the excluded object. Workaround - If you cannot upgrade immediately and FLS exclusion rules are used for object valued attributes (like ~object), add an additional exclusion rule for the members of the object (like ~object.*).
A vulnerability exists in Search Guard FLX versions 3.1.1 and earlier, where Field-Level Security (FLS) rules are not properly applied to object-valued fields. Although FLS exclusion rules can remove the object from the source data returned by search operations, the object's child attributes remain accessible to search queries. This flaw enables adversaries to infer or reconstruct the original contents of the excluded object.
Users are advised to upgrade to Search Guard FLX version 3.1.2 or later. If an immediate upgrade is not possible, and FLS exclusion rules are applied to object-valued attributes, an additional exclusion rule should be added for the object's members. For example, if the exclusion rule ~object is used, add ~object.* to exclude the child attributes as well.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2025CISA-ADP
Assessed Oct 29, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://docs.search-guard.com/latest/changelog-searchguard-flx-3_1_2 | [email protected] | Release NotesVendor |
| https://search-guard.com/cve-advisory/ | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-732 | Incorrect Permission Assignment for Critical Resource | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Search Guard FLX | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2025 | New CVE Received | [email protected] |