⤷ Title: Elastic Patches High-Severity Privilege Escalation Flaw in Elastic Cloud Enterprise (CVE-2025-37736)
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 03 Nov 2025 00:00:22 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #API Bypass #CVE_2025_37736 #ECE #Elastic #Improper Authorization #privilege escalation #Readonly User
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 03 Nov 2025 00:00:22 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #API Bypass #CVE_2025_37736 #ECE #Elastic #Improper Authorization #privilege escalation #Readonly User
Daily CyberSecurity
Elastic Patches High-Severity Privilege Escalation Flaw in Elastic Cloud Enterprise (CVE-2025-37736)
Elastic patched a Critical EoP flaw (CVE-2025-37736) in ECE (v3.8.3/4.0.3) where the readonly user can create admin users and inject new API keys by bypassing authorization checks.
⤷ Title: Improper Authorization Allows Account Takeover via Unlinked Phone Number and Email Change Without…
════════════════════════
𐀪 Author: oxmorv
════════════════════════
ⴵ Time: Mon, 12 Oct 2026 19:25:04 GMT
════════════════════════
⌗ Tags: #bussines_logic_error #improper_authorization #bug_bounty
════════════════════════
𐀪 Author: oxmorv
════════════════════════
ⴵ Time: Mon, 12 Oct 2026 19:25:04 GMT
════════════════════════
⌗ Tags: #bussines_logic_error #improper_authorization #bug_bounty
Medium
Improper Authorization Allows Account Takeover via Unlinked Phone Number and Email Change Without Old Email Verification
How an Unlinked Phone Number Bypassed Email Verification and Could Lead to Account Takeover