{"action":"Upgrade org.opensearch.plugin:opensearch-security to 2.19.3.0 or later.","affected":[{"fixed":"2.19.3.0","introduced":"0"}],"component":"org.opensearch.plugin:opensearch-security","cve_ids":[],"ecosystem":"Maven","exploited":false,"fixed_versions":["2.19.3.0"],"ghsa_id":"GHSA-rrmm-wq7q-h4v5","id":"tcs_01M5N9CESGRVRXNM4H5F6T1PTM","modified_at":"2025-08-01T19:00:20.275420Z","published_at":"2025-08-01T18:15:00Z","references":["https://osv.dev/vulnerability/GHSA-rrmm-wq7q-h4v5","https://github.com/opensearch-project/security/security/advisories/GHSA-rrmm-wq7q-h4v5","https://github.com/opensearch-project/security"],"severity":{"label":"medium","score":5.7},"sources":[{"source":"osv","source_id":"GHSA-rrmm-wq7q-h4v5","url":"https://osv.dev/vulnerability/GHSA-rrmm-wq7q-h4v5"}],"summary":"OpenSearch unauthorized data access on fields protected by field masking for fields of type ip, geo_point, geo_shape, xy_point, xy_shape"}