# Data is being shown sometimes without access **URL:** \ **Category:** Elastic Security\ **Tags:** docker\ **Created:** [August 17, 2023, 6:38am UTC](https://discuss.elastic.co/t/data-is-being-shown-sometimes-without-access/340968 "2023-08-17T06:38:24Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Amol\_Gaitonde1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amol_gaitonde1/32/122447_2.png) [@Amol\_Gaitonde1](https://discuss.elastic.co/u/Amol_Gaitonde1)\ **Post date:** [August 17, 2023, 6:38am UTC](https://discuss.elastic.co/t/data-is-being-shown-sometimes-without-access/340968/1 "2023-08-17T06:38:25Z")
We are on elastic version 8.8.1, build\_flavor is default and build\_type is docker. We have created an user test\_user with role role\_1 which has access to index\_1 and no other index. We are noticing a security issue that when I login as that user test\_user and try to access abc to which it does not have access. When I execute command in dev console or curl multiple times to access index abc, I get security exception which is fine. **ISSUE** : But on some attempts it shows the data which should NOT happen. When I execute the command some times I get security exception error (Correct) and sometimes I can see the data ( **ISSUE** ) . Has anyone faced this issue? Do we know what is the root cause or any recommendation for next step? Below are the test and results ```auto curl -XGET --user "test_user:password" "https://o11y-dev-es.idcmgt.intel.com/abc/_count" -H "kbn-xsrf: reporting" {"error":{"root_cause":[{"type":"security_exception","reason":"action [indices:data/read/search] is unauthorized for user [test_user] with effective roles [test_user] on indices [abc], this action is granted by the index privileges [read,all]"}],"type":"security_exception","reason":"action [indices:data/read/search] is unauthorized for user [test_user] with effective roles [test_user] on indices [abc], this action is granted by the index privileges [read,all]"},"status":403} curl -XGET --user "test_user:password" "https://o11y-dev-es.idcmgt.intel.com/abc/_count" -H "kbn-xsrf: reporting" {"count":907938,"_shards":{"total":1,"successful":1,"skipped":0,"failed":0}} curl -XGET --user "test_user:password" "https://o11y-dev-es.idcmgt.intel.com/abc/_count" -H "kbn-xsrf: reporting" {"count":907938,"_shards":{"total":1,"successful":1,"skipped":0,"failed":0}} curl -XGET --user "test_user:password" "https://o11y-dev-es.idcmgt.intel.com/abc/_count" -H "kbn-xsrf: reporting" {"count":907938,"_shards":{"total":1,"successful":1,"skipped":0,"failed":0}} curl -XGET --user "test_user:password" "https://o11y-dev-es.idcmgt.intel.com/abc/_count" -H "kbn-xsrf: reporting" {"error":{"root_cause":[{"type":"security_exception","reason":"action [indices:data/read/search] is unauthorized for user [test_user] with effective roles [test_user] on indices [abc], this action is granted by the index privileges [read,all]"}],"type":"security_exception","reason":"action [indices:data/read/search] is unauthorized for user [test_user] with effective roles [test_user] on indices [abc], this action is granted by the index privileges [read,all]"},"status":403} curl -XGET --user "test_user:password" "https://o11y-dev-es.idcmgt.intel.com/abc/_count" -H "kbn-xsrf: reporting" {"error":{"root_cause":[{"type":"security_exception","reason":"action [indices:data/read/search] is unauthorized for user [test_user] with effective roles [test_user] on indices [abc], this action is granted by the index privileges [read,all]"}],"type":"security_exception","reason":"action [indices:data/read/search] is unauthorized for user [test_user] with effective roles [test_user] on indices [abc], this action is granted by the index privileges [read,all]"},"status":403} ``` Thanks. ---
**Author:** ![Wave](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wave/32/117242_2.png) [@Wave](https://discuss.elastic.co/u/Wave)\ **Post date:** [August 21, 2023, 3:11pm UTC](https://discuss.elastic.co/t/data-is-being-shown-sometimes-without-access/340968/2 "2023-08-21T15:11:05Z")
Hi @Amol_Gaitonde1, Thank you for those logs. According to them giving the test\_user role read access on the abc index should solve that problem. [Roll documentation](https://www.elastic.co/guide/en/kibana/current/kibana-role-management.html). ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [August 21, 2023, 5:57pm UTC](https://discuss.elastic.co/t/data-is-being-shown-sometimes-without-access/340968/3 "2023-08-21T17:57:39Z")
> [@Amol\_Gaitonde1](#): > > But on some attempts it shows the data which should NOT happen. When I execute the command some times I get security exception error (Correct) and sometimes I can see the data This definitely should not happen, but can you provide a little more context? First, how did you created the user and the roles? Using REST requests to Elasticsearch or are you using [file based role management](https://www.elastic.co/guide/en/elasticsearch/reference/current/defining-roles.html#roles-management-file)? Second, you are making requests to `https://o11y-dev-es.idcmgt.intel.com`, is this a LB in front of your nodes? Can you share the logs from your elasticsearch when you make the requests? Also, please share your `elasticsearch.yml` and docker compose. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 18, 2023, 5:58pm UTC](https://discuss.elastic.co/t/data-is-being-shown-sometimes-without-access/340968/4 "2023-09-18T17:58:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.