{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/vearch/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:vearch:vearch:3.5.2:*:*:*:*:*:*:*","cpe:2.3:a:vearch:vearch:3.5.9:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-108746"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Vearch (3.5.2-3.5.9)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Vearch"],"content_html":"\u003cp\u003eVearch versions 3.5.2 through 3.5.9 are affected by an incorrect authorization vulnerability located in the Role.HasPermissionForResources function. The flaw manifests because the function fails to correctly validate or respect stored ReadOnly or None privilege levels assigned to resources within a role. Consequently, an authenticated user who is not a root administrator can bypass these restrictions to perform unauthorized upsert and delete operations on documents. Furthermore, the vulnerability enables an attacker to manipulate role permissions via the PUT /roles API to grant their own account WriteRead privileges, facilitating an escalation of access toward cluster administrator. This issue represents a significant risk to data integrity and cluster security, as it allows standard authenticated users to transcend their intended access controls within the Vearch distributed vector database environment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows authenticated users to read, modify, or delete sensitive data within the Vearch database regardless of assigned read-only restrictions. By leveraging the PUT /roles API, an attacker can grant themselves administrative privileges, potentially leading to full control over the Vearch cluster. This vulnerability affects all environments running Vearch versions 3.5.2 through 3.5.9.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Vearch to a version outside the affected range (3.5.2-3.5.9).\u003c/li\u003e\n\u003cli\u003eImplement strict network segmentation to limit access to the Vearch API, especially the /roles endpoint.\u003c/li\u003e\n\u003cli\u003eReview all current role and privilege assignments in the Vearch cluster for unauthorized modifications or unexpected elevated permissions.\u003c/li\u003e\n\u003cli\u003eEnable strict API access logging to detect unauthorized calls to the PUT /roles endpoint.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-11T14:01:43Z","date_published":"2026-10-11T14:01:43Z","id":"https://feed.craftedsignal.io/briefs/2026-10-vearch-auth-bypass/","summary":"Vearch versions 3.5.2 through 3.5.9 contain an incorrect authorization vulnerability allowing authenticated non-root users to perform unauthorized document modifications and escalate privileges to cluster administrator.","title":"Vearch Incorrect Authorization Vulnerability (CVE-2026-108746)","url":"https://feed.craftedsignal.io/briefs/2026-10-vearch-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Vearch","version":"https://jsonfeed.org/version/1.1"}