Elastic Patches High-Severity Privilege Escalation Flaw in Elastic Cloud Enterprise (CVE-2025-37736)

Elastic has issued a security advisory for a high-severity vulnerability (CVE-2025-37736, CVSS 8.8) in Elastic Cloud Enterprise (ECE) that could let a readonly user perform unauthorised operations and escalate privileges across managed Elastic environments, including on‑premises and hybrid deployments. According to the advisory, improper authorization in Elastic Cloud Enterprise can lead to Privilege Escalation where the built-in readonly user can call APIs that should not be allowed.

The flaw stems from access-control weaknesses on several critical API endpoints related to user and service account management, enabling the readonly role to perform actions such as creating, deleting or modifying users, injecting new API keys, or gaining administrative access. Affected ECE versions are after 3.8.0 and up to and including 3.8.2, and after 4.0.0 and up to and including 4.0.2; Elastic has released patched versions 3.8.3 and 4.0.3.

Administrators are advised to upgrade and to use a provided open-source cleanup utility on GitHub to identify and remove any unauthorized accounts created by the readonly user, while exercising caution during cleanup.