Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-108746— Vearch 3.5.2 through 3.5.9 Incorrect Authorization via Role.HasPermissionForResources

Quick assessment

Affected
Vearch vearch
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Vearch 3.5.2 至 3.5.9 版本中存在一个角色权限检查（Role.HasPermissionForResources）的逻辑错误漏洞。该漏洞未能正确忽略角色中资源所配置的只读（ReadOnly）或无权限（None）级别，导致权限校验失效。已认证的非 root 用户可以在拥有只读权限的情况下，执行文档的 upsert（插入或更新）和删除操作；此外，还可通过调用 PUT /roles 接口，将自身角色权限提升至 WriteRead（读写）级别，从而进一步提权至集群管理员权限。

CVSS 8.8 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
Vearch vearch 3.5.2≤ 3.5.9 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-108746

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Vearch 3.5.2 through 3.5.9 Incorrect Authorization via Role.HasPermissionForResources
Source: CVE Program / CVE List V5
Vulnerability Description
Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege levels for resources listed in a role. Authenticated non-root users can upsert and delete documents with read-only access, or call PUT /roles to grant their role WriteRead privileges, escalating toward cluster administrator access.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Vearch vearch 3.5.2 ~ 3.5.9 -

II. Public POCs for CVE-2026-108746

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-108746

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-108746 (2)

Vendor Advisories for CVE-2026-108746 (1)

Security Blog Posts for CVE-2026-108746 (1)

Other References for CVE-2026-108746 (1)

IV. Related Vulnerabilities

Same weakness: CWE-863

V. Comments for CVE-2026-108746

No comments yet

Leave a comment