{"id":"CVE-2026-108746","published":"2026-10-11T13:17:19.230","lastModified":"2026-10-16T19:18:44.867","description":"Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege levels for resources listed in a role. Authenticated non-root users can upsert and delete documents with read-only access, or call PUT /roles to grant their role WriteRead privileges, escalating toward cluster administrator access.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://github.com/vearch/vearch","tags":[]},{"url":"https://github.com/vearch/vearch/blob/bae78b189ff0ab1d8ac659c6acaeeb5f630db33f/internal/entity/user.go#L300-L313","tags":[]},{"url":"https://github.com/vearch/vearch/blob/bae78b189ff0ab1d8ac659c6acaeeb5f630db33f/internal/master/services/role_service.go#L180-L229","tags":[]},{"url":"https://hackmd.io/@haind/vearch-rbac-privilege-level-ignored-authz-bypass","tags":[]},{"url":"https://www.vulncheck.com/advisories/vearch-3.5.2-through-3.5.9-incorrect-authorization-via-role-haspermissionforresources","tags":[]},{"url":"https://hackmd.io/@haind/vearch-rbac-privilege-level-ignored-authz-bypass","tags":[]}],"exploitRefs":[{"url":"https://github.com/vearch/vearch","tags":[]},{"url":"https://github.com/vearch/vearch/blob/bae78b189ff0ab1d8ac659c6acaeeb5f630db33f/internal/entity/user.go#L300-L313","tags":[]},{"url":"https://github.com/vearch/vearch/blob/bae78b189ff0ab1d8ac659c6acaeeb5f630db33f/internal/master/services/role_service.go#L180-L229","tags":[]}],"hasPoc":true,"ai":{"summary":"Vearch allows authenticated users with read-only roles to perform write operations like upserting and deleting documents, bypassing expected authorization controls. This flaw enables privilege escalation where users can effectively gain write access to resources they shouldn't be able to modify.","exploitability":"The vulnerability is easily exploitable by any authenticated user who has a role with ReadOnly or None privileges, requiring no special conditions beyond having an account and accessing the system.","blast_radius":"An attacker could potentially compromise entire document collections by leveraging this authorization bypass to modify or delete data, and could escalate their access to cluster administrator level through role modification endpoints.","remediation":"Upgrade to Vearch version 3.5.10 or later to fix the incorrect authorization vulnerability in Role.HasPermissionForResources.","detection":"Monitor for unauthorized PUT /roles API calls from non-admin users, and watch for unexpected write operations (upsert/delete) performed by users with ReadOnly roles in access logs.","tags":["authorization","privilege-escalation","api","auth-bypass","data-loss"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:55:30.746Z"}}