Vearch Incorrect Authorization Vulnerability (CVE-2026-108746)

Vearch versions 3.5.2 through 3.5.9 are affected by an incorrect authorization vulnerability located in the Role.HasPermissionForResources function. The flaw manifests because the function fails to correctly validate or respect stored ReadOnly or None privilege levels assigned to resources within a role. Consequently, an authenticated user who is not a root administrator can bypass these restrictions to perform unauthorized upsert and delete operations on documents. Furthermore, the vulnerability enables an attacker to manipulate role permissions via the PUT /roles API to grant their own account WriteRead privileges, facilitating an escalation of access toward cluster administrator. This issue represents a significant risk to data integrity and cluster security, as it allows standard authenticated users to transcend their intended access controls within the Vearch distributed vector database environment.

Impact

Successful exploitation allows authenticated users to read, modify, or delete sensitive data within the Vearch database regardless of assigned read-only restrictions. By leveraging the PUT /roles API, an attacker can grant themselves administrative privileges, potentially leading to full control over the Vearch cluster. This vulnerability affects all environments running Vearch versions 3.5.2 through 3.5.9.

Recommendation

• Upgrade Vearch to a version outside the affected range (3.5.2-3.5.9).
• Implement strict network segmentation to limit access to the Vearch API, especially the /roles endpoint.
• Review all current role and privilege assignments in the Vearch cluster for unauthorized modifications or unexpected elevated permissions.
• Enable strict API access logging to detect unauthorized calls to the PUT /roles endpoint.