CVE-2026-108746

Summary

Vearch allows authenticated users with read-only roles to perform write operations like upserting and deleting documents, bypassing expected authorization controls. This flaw enables privilege escalation where users can effectively gain write access to resources they shouldn't be able to modify.

Exploitability

The vulnerability is easily exploitable by any authenticated user who has a role with ReadOnly or None privileges, requiring no special conditions beyond having an account and accessing the system.

Blast radius

An attacker could potentially compromise entire document collections by leveraging this authorization bypass to modify or delete data, and could escalate their access to cluster administrator level through role modification endpoints.

Detection

Monitor for unauthorized PUT /roles API calls from non-admin users, and watch for unexpected write operations (upsert/delete) performed by users with ReadOnly roles in access logs.

Prioritized remediation

Upgrade to Vearch version 3.5.10 or later to fix the incorrect authorization vulnerability in Role.HasPermissionForResources.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.