CVE-2026-108746

Name of the Vulnerable Software and Affected Versions Vearch versions 3.5.2 through 3.5.9

Description An incorrect authorization issue exists in the HasPermissionForResources() function. This flaw allows the system to ignore stored ReadOnly or None privilege levels for resources assigned to a role. Consequently, authenticated non-root users can perform unauthorized actions, such as upserting and deleting documents they only have read-only access to, or accessing the 'PUT /roles' endpoint to grant their own role WriteRead privileges, potentially leading to cluster administrator access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.