Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None… (CVE-2026-108746)

The vulnerability in Vearch 3.5.2 through 3.5.9 lies in the Role.HasPermissionForResources authorization logic, which fails to enforce stored ReadOnly or None privileges for resources associated with a role. This incorrect authorization allows authenticated users with limited privileges to perform unauthorized document modifications and escalate their role permissions via the PUT /roles endpoint, leading to potential full cluster administrator access.

This vulnerability allows authenticated non-root users to bypass intended access controls, enabling them to modify or delete documents despite having only read-only permissions. Furthermore, they can escalate their privileges to cluster administrator level by modifying their role permissions. The impact includes full confidentiality, integrity, and availability compromise of the affected Vearch cluster.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Vearch cluster to trusted users only and monitor for suspicious role modification attempts. Avoid granting unnecessary privileges to users and consider disabling or restricting the PUT /roles endpoint if possible.