Auth bypass in Floragunn Search Guard Flx
CVE-2025-12149
In Search Guard FLX versions 3.1.2 and earlier, while Document-Level Security (DLS) is correctly enforced elsewhere, when the search is triggered from a Signals watch, the DLS rule is not enforced, allowing access to all documents in the q…
Vulnerability class: Information Disclosure
EPSS: 0.001 (16.6th percentile) — read the EPSS interpretation.
Affected products
- Floragunn Search Guard Flx — versions 1.0.0