CVE-2025-13653 MEDIUM

CVE-2025-13653: Unauthorized access to documents in data streams with specially crafted requests

Vendor Floragunn
Product Search Guard FLX
Weakness CWE-200 · Info exposure
Published December 1, 2025
Last update December 1, 2025
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

In Search Guard FLX versions from 3.1.0 up to 4.0.0 with enterprise modules being disabled, there exists an issue which allows authenticated users to use specially crafted requests to read documents from data streams without having the respective privileges.

Key dates

02Disclosure timeline

December 1, 2025 CVE published
December 1, 2025 Record updated