Vearch 3.5.2 through 3.5.9 Incorrect Authorization via Role.HasPermissionForResources
Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege levels for resources listed in a role. Authenticated non-root users can upsert and delete documents with read-only access, or call PUT /roles to grant their role WriteRead privileges, escalating toward cluster administrator access.
CVE-2026-108746
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-108746
vearch
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/vearch/vearch",
"vendor": "Vearch",
"product": "vearch",
"versions": [
{
"status": "affected",
"version": "3.5.2",
"versionType": "semver",
"lessThanOrEqual": "3.5.9"
}
],
"packageURL": "pkg:golang/github.com/vearch/vearch/v3",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-108746
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #17298 · Revision 1
- Added to Heist Feed
- Publisher date