Vulnerability · Published Oct 11, 2026 · Assigned by VulnCheck

CVE-2026-108746Vearch 3.5.2 through 3.5.9 Incorrect Authorization via Role.HasPermissionForResources

High 8.8

In plain English

A high-severity incorrect authorization in vearch from Vearch. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.4%top 70.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege levels for resources listed in a role. Authenticated non-root users can upsert and delete documents with read-only access, or call PUT /roles to grant their role WriteRead privileges, escalating toward cluster administrator access.

Affected products (as reported)

Vendor	Product	Versions
Vearch	vearch	3.5.2 – through 3.5.9

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://hackmd.io/@haind/vearch-rbac-privilege-level-ignored-authz-bypass third-party-advisory
https://github.com/vearch/vearch/blob/bae78b189ff0ab1d8ac659c6acaeeb5f630db33f/internal/entity/user.go#L300-L313 technical-description
https://github.com/vearch/vearch/blob/bae78b189ff0ab1d8ac659c6acaeeb5f630db33f/internal/master/services/role_service.go#L180-L229 technical-description
https://github.com/vearch/vearch product
VulnCheck Advisory: Vearch 3.5.2 through 3.5.9 Incorrect Authorization via Role.HasPermissionForResources third-party-advisory