{"id":"GHSA-x83w-23jp-g6pw","aliases":[],"status":"published","title":"OpenSearch Security plugin: DLS not applied on documents linked by has_child or has_parent relation","description":"### Description\n\nA flaw was identified in the OpenSearch Security plugin's document-level security (DLS) implementation. DLS restrictions were not correctly applied to search queries that use has_parent or has_child join relations. This could allow an authenticated user to access document contents that should have been restricted by DLS rules.\n\n### Impact\n\nAn authenticated user with access to an index containing parent/child join relations could bypass DLS restrictions on documents linked by those relations, potentially accessing restricted document contents. This only affects clusters that use both DLS and the `join` field type on the same index.\n\n### Patches\n\n This issue is fixed in OpenSearch `2.19.4` and `3.2.0`.\n\n### Workarounds\n\nAvoid using the `join` field type on indices that are subject to DLS rules.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-05-07T00:08:34Z","modified":"2026-05-07T00:21:03Z","fixes":[{"ecosystem":"Maven","package":"org.opensearch.plugin:opensearch-security","fixed_in":["2.19.4.0","3.2.0.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.opensearch.plugin:opensearch-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"last_affected":"2.19.3"},{"fixed":"2.19.4.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.opensearch.plugin:opensearch-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"last_affected":"3.1.0"},{"fixed":"3.2.0.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.opensearch.plugin:opensearch-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"2.19.4.0"}]}],"versions":["2.1.0.0","2.10.0.0","2.11.0.0","2.11.1.0","2.12.0.0","2.13.0.0","2.14.0.0","2.15.0.0","2.16.0.0","2.17.0.0","2.17.1.0","2.18.0.0","2.19.0.0","2.19.1.0","2.19.2.0","2.19.3.0","2.2.0.0","2.2.1.0","2.3.0.0","2.4.0.0","2.4.1.0","2.5.0.0","2.6.0.0","2.7.0.0","2.8.0.0","2.9.0.0"]},{"source":"osv","ecosystem":"Maven","package":"org.opensearch.plugin:opensearch-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.2.0.0"}]}],"versions":["3.0.0.0","3.1.0.0"]}],"references":[{"url":"https://github.com/opensearch-project/security/security/advisories/GHSA-x83w-23jp-g6pw","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x83w-23jp-g6pw"},{"url":"https://github.com/opensearch-project/security","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-x83w-23jp-g6pw","title":"OpenSearch Security plugin: DLS not applied on documents linked by has_child or has_parent relation","description":"### Description\n\nA flaw was identified in the OpenSearch Security plugin's document-level security (DLS) implementation. DLS restrictions were not correctly applied to search queries that use has_parent or has_child join relations. This could allow an authenticated user to access document contents that should have been restricted by DLS rules.\n\n### Impact\n\nAn authenticated user with access to an index containing parent/child join relations could bypass DLS restrictions on documents linked by those relations, potentially accessing restricted document contents. This only affects clusters that use both DLS and the `join` field type on the same index.\n\n### Patches\n\n This issue is fixed in OpenSearch `2.19.4` and `3.2.0`.\n\n### Workarounds\n\nAvoid using the `join` field type on indices that are subject to DLS rules.","status":"published","published":"2026-05-07T00:08:34Z","modified":"2026-05-07T00:08:36Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:40:02.883746Z"}],"osv":[{"id":"GHSA-x83w-23jp-g6pw","title":"OpenSearch Security plugin: DLS not applied on documents linked by has_child or has_parent relation","description":"### Description\n\nA flaw was identified in the OpenSearch Security plugin's document-level security (DLS) implementation. DLS restrictions were not correctly applied to search queries that use has_parent or has_child join relations. This could allow an authenticated user to access document contents that should have been restricted by DLS rules.\n\n### Impact\n\nAn authenticated user with access to an index containing parent/child join relations could bypass DLS restrictions on documents linked by those relations, potentially accessing restricted document contents. This only affects clusters that use both DLS and the `join` field type on the same index.\n\n### Patches\n\n This issue is fixed in OpenSearch `2.19.4` and `3.2.0`.\n\n### Workarounds\n\nAvoid using the `join` field type on indices that are subject to DLS rules.","status":"published","published":"2026-05-07T00:08:34Z","modified":"2026-05-07T00:21:03.836489Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:59.835583Z"}]}}