CVE-2026-108746: Vearch 3.5.2 through 3.5.9 Incorrect Authorization via Role.HasPermissionForResources
Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege levels for resources listed in a role. Authenticated non-root users can upsert and delete documents with read-only access, or call PUT /roles to grant their role WriteRead privileges, escalating toward cluster administrator access.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated non-root Vearch user whose role includes resources with stored ReadOnly or None privilege levels can exploit the authorization failure. The issue is remotely reachable and does not require user interaction.
What actions can an attacker take?
A user with read-only access can upsert or delete documents. They can also use PUT /roles to grant their own role WriteRead privileges, enabling escalation toward cluster administrator access.
Are deployments using restricted roles affected?
Yes. The vulnerable authorization check ignores stored ReadOnly and None privilege levels for resources listed in a role, so roles intended to restrict access do not enforce those privilege levels correctly.
How can I identify potentially affected users or roles?
Review non-root roles that list resources with ReadOnly or None privileges, particularly accounts that can reach document upsert/delete operations or the PUT /roles endpoint. In affected versions, those stored restrictions may not prevent the corresponding write or role-modification actions.