Comment by rieTohgh6

Almost all security issues with ES stem from their idea to keep authorization as separate, paid product (X-pack). On other other hand MongoDB had similar issues since they wanted to their product to be easy to setup and use, maybe for people scarred of pg_hba.conf.