Comment by FZ1

"Elasticsearch has no concept of a user. Essentially, anyone that can send arbitrary requests to your cluster is a “super user”. "

https://www.elastic.co/de/blog/found-elasticsearch-security

This document says it twice verbatim - once as an emphasizes blurb of its own. It is also re-emphasized it in several other ways.

(same link as also posted by the Elasticsearch employee above).