Incorrect Authorization Vulnerability in Vearch by Vearch
CVE-2026-108746
8.7HIGH
What is CVE-2026-108746?
The Vearch product versions 3.5.2 through 3.5.9 suffer from an incorrect authorization vulnerability in the Role.HasPermissionForResources function. This issue fails to properly enforce stored ReadOnly or None privilege levels for resources linked to a role. As a consequence, authenticated non-root users can bypass access controls, enabling them to insert and delete documents despite having read-only status. Furthermore, these users can exploit the vulnerability to escalate privileges by modifying their roles to include WriteRead access, potentially leading to cluster administrator rights.
Affected Version(s)
vearch 3.5.2 <= 3.5.9
References
CVSS V4
Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
HaiND from the Post and Telecommunication Institute of Technology