CVE-2026-108746 Details
Description
Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege levels for resources listed in a role. Authenticated non-root users can upsert and delete documents with read-only access, or call PUT /roles to grant their role WriteRead privileges, escalating toward cluster administrator access.
A vulnerability exists in Vearch versions 3.5.2 through 3.5.9, where the Role.HasPermissionForResources function improperly authorizes actions by ignoring the assigned ReadOnly or None privilege levels for certain resources. This flaw allows authenticated non-root users to delete or upsert documents, even when their role is supposed to be read-only. Additionally, users can manipulate their roles to gain elevated privileges, potentially leading to cluster administrator access.
The vulnerability can be fixed by updating the Role.HasPermissionForResources function to correctly enforce privilege denials for mismatched or None values. After applying this fix, the authorization logic should be tested to ensure it properly restricts access as intended.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 11, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Vearch | >= 3.5.2, <= 3.5.9 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 11, 2026 | New CVE Received | [email protected] |