CVE-2025-37736: Elastic Cloud Enterprise Privilege Escalation

CVE-2025-37736 Overview

CVE-2025-37736 is an improper authorization vulnerability in Elastic Cloud Enterprise (ECE) that enables privilege escalation. The built-in readonly user can invoke administrative APIs that should be restricted to higher-privileged accounts. An authenticated attacker holding read-only credentials can create or modify service accounts, manage API keys, and create or delete users. The flaw maps to CWE-863: Incorrect Authorization and affects ECE deployments prior to versions 3.8.3 and 4.0.3. Elastic addressed the issue in the ESA-2025-22 security update.

Critical Impact
An authenticated read-only user can escalate privileges by abusing service-account, API-key, and user-management endpoints, compromising the confidentiality, integrity, and availability of the ECE control plane.

Affected Products

Elastic Cloud Enterprise versions prior to 3.8.3
Elastic Cloud Enterprise 4.0.x versions prior to 4.0.3
Self-managed ECE orchestrator deployments

Discovery Timeline

2025-11-07 - CVE-2025-37736 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-37736

Vulnerability Analysis

The vulnerability resides in the authorization layer of the ECE platform API. The built-in readonly role should be limited to passive read operations across the orchestrator. Instead, the role passes authorization checks on a set of state-changing endpoints that manage service accounts, API keys, and user records. An attacker with valid read-only credentials can therefore perform write operations that the role definition implies are forbidden. Because these endpoints control identity primitives, abuse leads directly to privilege escalation across the ECE control plane.

Root Cause

The root cause is missing or incorrect role-based access control enforcement on selected platform API routes. The authorization handler evaluates authentication successfully but fails to verify that the calling principal possesses the privilege required for the requested action. This is a classic CWE-863 defect where the policy decision point does not match the documented role contract.

Attack Vector

An attacker authenticated as the readonly user issues HTTP requests over the network to the ECE API. The affected routes include:

POST /platform/configuration/security/service-accounts
DELETE and PATCH /platform/configuration/security/service-accounts/{user_id}
POST /platform/configuration/security/service-accounts/{user_id}/keys
DELETE /platform/configuration/security/service-accounts/{user_id}/keys/{api_key_id}
PATCH /user, POST /users, PATCH /users/{user_name}, DELETE /users/{user_name}
POST, DELETE /users/auth/keys, DELETE /users/auth/keys/_all, DELETE /users/auth/keys/{api_key_id}
DELETE /users/{user_id}/auth/keys and DELETE /users/{user_id}/auth/keys/{api_key_id}

By creating a new service account with elevated rights or by minting API keys for existing privileged accounts, the attacker establishes persistent administrative access. Deleting authentication keys for other users provides a denial-of-service path against legitimate operators.

No public proof-of-concept exploit is referenced in the advisory, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Elastic ESA-2025-22 advisory for vendor technical details.

Detection Methods for CVE-2025-37736

Indicators of Compromise

Audit log entries showing the readonly user invoking POST, PATCH, or DELETE requests against /platform/configuration/security/service-accounts or /users routes.
Creation of new service accounts or API keys without a corresponding change-management ticket.
Unexpected deletion of API keys via /users/auth/keys/_all or /users/{user_id}/auth/keys.
New administrator-equivalent users created shortly after a readonly session authenticated.

Detection Strategies

Parse ECE proxy and admin console access logs for write-method HTTP verbs originating from sessions tied to the readonly role.
Correlate identity events: a readonly authentication followed by service-account or user mutations within the same source IP or session ID is high-fidelity evidence of exploitation.
Baseline normal API usage per role and alert on deviations, especially privilege-management endpoints.

Monitoring Recommendations

Ship ECE audit logs to a centralized SIEM or data lake and retain them for at least 90 days.
Alert on any successful 2xx response to the affected endpoints when the caller is not in an administrative role.
Monitor for newly created API keys and service accounts and require out-of-band approval workflows for any such changes.

How to Mitigate CVE-2025-37736

Immediate Actions Required

Upgrade ECE to version 3.8.3 or 4.0.3 (or later) as published in ESA-2025-22.
Rotate credentials and API keys for all built-in users, including the readonly account.
Audit recently created service accounts, users, and API keys and remove any that are unauthorized.
Restrict network access to the ECE admin API to trusted management networks only.

Patch Information

Elastic released fixes in Elastic Cloud Enterprise 3.8.3 and 4.0.3. The patched releases enforce the correct role checks on the platform security and user-management endpoints. Customers running earlier 3.8.x or 4.0.x builds must upgrade. Refer to the vendor advisory ESA-2025-22 for full version coverage and upgrade procedures.

Workarounds

Disable or restrict the built-in readonly user until the patch is applied.
Place the ECE API behind a reverse proxy that denies write methods on the affected routes for non-administrative principals.
Enforce network segmentation so only operators on a privileged jump host can reach the ECE control-plane API.

bash

# Example reverse-proxy guard restricting write methods on sensitive ECE routes
# (applies until ECE 3.8.3 / 4.0.3 is deployed)
location ~ ^/api/v1/(platform/configuration/security/service-accounts|users) {
    limit_except GET HEAD {
        allow 10.0.10.0/24;   # admin jump network
        deny all;
    }
    proxy_pass https://ece-coordinator.internal;
}