Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-108746: Vearch lets read‑only users modify data
CVE-2026-108746 · published today
Summary
Versions 3.5.2 through 3.5.9 of Vearch do not correctly check permission levels, so users who should only view data can add, change, or delete records. This also lets them change their own role to gain write rights, potentially leading to full control of the system. Update to a patched version or restrict access to trusted users until the fix is applied.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| vearch | vearch | <= 3.5.9 |
Original advisory text
Vearch 3.5.2 through 3.5.9 Incorrect Authorization via Role.HasPermissionForResources
Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege levels for resources listed in a role. Authenticated non-root users can upsert and delete documents with read-only access, or call PUT /roles to grant their role WriteRead privileges, escalating toward cluster administrator access.
References
- https://github.com/vearch/vearch/blob/bae78b189ff0ab1d8ac659c6acaeeb5f630db33f/i... Third Party Advisory
- https://github.com/vearch/vearch Product
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-1087... Vendor Advisory
- https://github.com/vearch/vearch/blob/bae78b189ff0ab1d8ac659c6acaeeb5f630db33f/i... Third Party Advisory
- https://hackmd.io/@haind/vearch-rbac-privilege-level-ignored-authz-bypass Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-108746 Vendor Advisory
- https://www.vulncheck.com/advisories/vearch-3.5.2-through-3.5.9-incorrect-author... Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Severity
9.4
Critical
Type
CWE-863Incorrect Authorization
Timeline
Published11 Oct 2026
Updated12 Oct 2026
First seen11 Oct 2026
Track software like this
Free during beta