CVE-2022-41918

OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the indices that back data streams potentially leading to incorrect access authorization. OpenSearch 1.3.7 and 2.4.0 contain a fix for this issue. Users are advised to update. There are no known workarounds for this issue.

• CWE-612
• CWE-863

• https://github.com/opensearch-project/security/commit/f7cc569c9d3fa5d5432c76c854eed280d45ce6f4Patch, Third Party Advisory
• https://github.com/opensearch-project/security/security/advisories/GHSA-wmx7-x4jp-9jggThird Party Advisory
• https://github.com/opensearch-project/security/commit/f7cc569c9d3fa5d5432c76c854eed280d45ce6f4Patch, Third Party Advisory
• https://github.com/opensearch-project/security/security/advisories/GHSA-wmx7-x4jp-9jggThird Party Advisory

Published

Nov 15, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-41912The crewjam/saml go library prior to version 0.4.9 is vulner…9.8
• CVE-2022-41913Discourse-calendar is a plugin for the Discourse messaging p…5.4
• CVE-2022-41914Zulip is an open-source team collaboration tool. For organiz…3.7
• CVE-2022-41915Netty project is an event-driven asynchronous network applic…6.5
• CVE-2022-41916Heimdal is an implementation of ASN.1/DER, PKIX, and Kerbero…7.5
• CVE-2022-41917OpenSearch is a community-driven, open source fork of Elasti…4.3
• CVE-2022-41919Fastify is a web framework with minimal overhead and plugin …8.8
• CVE-2022-4192Use after free in Live Caption in Google Chrome prior to 108…8.8
• CVE-2022-41920Lancet is a general utility library for the go programming l…8.8
• CVE-2022-41921Discourse is an open-source discussion platform. Prior to ve…4.3
• CVE-2022-41922`yiisoft/yii` before version 1.1.27 are vulnerable to Remote…9.8
• CVE-2022-41923Grails Spring Security Core plugin is vulnerable to privileg…9.8