{"id":"GHSA-x83w-23jp-g6pw","summary":"OpenSearch Security plugin: DLS not applied on documents linked by has_child or has_parent relation","details":"### Description\n\nA flaw was identified in the OpenSearch Security plugin's document-level security (DLS) implementation. DLS restrictions were not correctly applied to search queries that use has_parent or has_child join relations. This could allow an authenticated user to access document contents that should have been restricted by DLS rules.\n\n### Impact\n\nAn authenticated user with access to an index containing parent/child join relations could bypass DLS restrictions on documents linked by those relations, potentially accessing restricted document contents. This only affects clusters that use both DLS and the `join` field type on the same index.\n\n### Patches\n\n This issue is fixed in OpenSearch `2.19.4` and `3.2.0`.\n\n### Workarounds\n\nAvoid using the `join` field type on indices that are subject to DLS rules.","modified":"2026-05-07T00:21:03.836489Z","published":"2026-05-07T00:08:34Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-05-07T00:08:34Z","nvd_published_at":null,"cwe_ids":["CWE-863"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/opensearch-project/security/security/advisories/GHSA-x83w-23jp-g6pw"},{"type":"PACKAGE","url":"https://github.com/opensearch-project/security"}],"affected":[{"package":{"name":"org.opensearch.plugin:opensearch-security","ecosystem":"Maven","purl":"pkg:maven/org.opensearch.plugin/opensearch-security"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"2.19.4.0"}]}],"versions":["2.1.0.0","2.10.0.0","2.11.0.0","2.11.1.0","2.12.0.0","2.13.0.0","2.14.0.0","2.15.0.0","2.16.0.0","2.17.0.0","2.17.1.0","2.18.0.0","2.19.0.0","2.19.1.0","2.19.2.0","2.19.3.0","2.2.0.0","2.2.1.0","2.3.0.0","2.4.0.0","2.4.1.0","2.5.0.0","2.6.0.0","2.7.0.0","2.8.0.0","2.9.0.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-x83w-23jp-g6pw/GHSA-x83w-23jp-g6pw.json","last_known_affected_version_range":"\u003c= 2.19.3"}},{"package":{"name":"org.opensearch.plugin:opensearch-security","ecosystem":"Maven","purl":"pkg:maven/org.opensearch.plugin/opensearch-security"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.2.0.0"}]}],"versions":["3.0.0.0","3.1.0.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-x83w-23jp-g6pw/GHSA-x83w-23jp-g6pw.json","last_known_affected_version_range":"\u003c= 3.1.0"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}]}