# Elastic Sharepoint Online Python Connector v8.10.3.0 Security Update

**URL:** <https://discuss.elastic.co/t/elastic-sharepoint-online-python-connector-v8-10-3-0-security-update/344732>\
**Category:** Security Announcements\
**Created:** [October 10, 2023, 12:18pm UTC](https://discuss.elastic.co/t/elastic-sharepoint-online-python-connector-v8-10-3-0-security-update/344732 "2023-10-10T12:18:57Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![ismisepaul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ismisepaul/32/102235_2.png) [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\
**Post date:** [October 10, 2023, 12:18pm UTC](https://discuss.elastic.co/t/elastic-sharepoint-online-python-connector-v8-10-3-0-security-update/344732/1 "2023-10-10T12:18:57Z")

</div>

**Elastic Sharepoint Online Python Connector Improper Access Control (ESA-2023-18)**

An issue was discovered when using Document Level Security and the SPO "Limited Access" functionality in Elastic Sharepoint Online Python Connector.

If a user is assigned limited access permissions to an item on a Sharepoint site then that user would have read permissions to all content on the Sharepoint site through Elasticsearch.

**Affected Versions:**  
Elastic Sharepoint Online Python Connector Before v8.10.3.0

**Solutions and Mitigations:**  
The issue is resolved in Elastic Sharepoint Online Python Connector v8.10.3.0 and above

CVSSv3: 5.3 (Medium) - [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)  
CVE-2023-46666

---

_[View the full topic](https://discuss.elastic.co/t/elastic-sharepoint-online-python-connector-v8-10-3-0-security-update/344732)._