Vearch: Incorrect authorization in role permission check
Summary
Vearch 3.5.2 through 3.5.9 ignores the stored ReadOnly and None privilege levels of resources assigned to a role. An authenticated non-root user can therefore upsert and delete documents they should only be able to read, or use the role API (PUT /roles) to grant their role WriteRead privileges, which can lead toward cluster administrator access. The attack requires a valid non-root account.
Affected
- Vearch 3.5.2 through 3.5.9
- Default configuration: not affected (per the CNA)
Fixed in
- Unknown. No vendor advisory or fixed release was found in the sources.
- Latest release found in the sources: v3.5.9, which is within the affected range.
Workaround
- None documented by the vendor.
- Restrict network access to the Vearch master and API to trusted hosts and admin networks.
- Review roles and remove unnecessary non-root accounts.
Exploitation
- CISA SSVC: exploitation status 'poc', not automatable, total technical impact.
- Not marked as known exploited (KEV).
- A public proof of concept could not be verified.
- EPSS: 0.00283 (low).
Our recommendation
- Check whether Vearch 3.5.2 to 3.5.9 is in use and whether its API is reachable from untrusted networks.
- Restrict API access and review all non-root accounts and roles.
- Monitor for unexpected document changes and role modifications.
- Watch the upstream repository for a fixed release and update as soon as one is available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- OSV: CVE-2026-108746 osv.dev
- VulnCheck advisory: Vearch incorrect authorization www.vulncheck.com
- Vearch GitHub repository github.com
- Vearch releases github.com
- Vearch user.go at affected commit github.com
- Vearch role_service.go at affected commit github.com
- HackMD write-up: Vearch RBAC privilege level ignored hackmd.io
- HOL Guard: CVE-2026-108746 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:03.
Original description (NVD)
Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege levels for resources listed in a role. Authenticated non-root users can upsert and delete documents with read-only access, or call PUT /roles to grant their role WriteRead privileges, escalating toward cluster administrator access.
NVD references (6)
- https://github.com/vearch/vearch
- https://github.com/vearch/vearch/blob/bae78b189ff0ab1d8ac659c6acaeeb5f630db33f/internal/entity/user.go#L300-L…
- https://github.com/vearch/vearch/blob/bae78b189ff0ab1d8ac659c6acaeeb5f630db33f/internal/master/services/role_…
- https://hackmd.io/@haind/vearch-rbac-privilege-level-ignored-authz-bypass
- https://www.vulncheck.com/advisories/vearch-3.5.2-through-3.5.9-incorrect-authorization-via-role-haspermissio…
- https://hackmd.io/@haind/vearch-rbac-privilege-level-ignored-authz-bypass
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.