CVE-2026-108746 Vearch 3.5.2 through 3.5.9 Incorrect Authorization via Role.HasPermissionForResources
Authenticated users can bypass read-only restrictions to modify data and escalate privileges to cluster administrator in Vearch.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-108746?
CVE-2026-108746 is a high-severity missing authorization vulnerability in vearch, published on 11 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege levels for resources listed in a role. Authenticated non-root users can upsert and delete documents with read-only access, or call PUT /roles to grant their role WriteRead privileges, escalating toward cluster administrator access.
Weakness: CWE-863
Which versions are affected by CVE-2026-108746?
How do I fix CVE-2026-108746?
No fix has been published for CVE-2026-108746 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-108746 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-108746 exists.
Sources
Also known as GHSA-73v4-h56h-crx9.