CVE-2026-108746

Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege levels for resources listed in a role. Authenticated non-root users can upsert and delete documents with read-only access, or call PUT /rol...

CVE-2026-108746

Vearch versions 3.5.2 through 3.5.9 are vulnerable to an incorrect authorization flaw in Role.HasPermissionForResources. The root cause is that the system ignores stored ReadOnly or None privilege levels for resources included in a role. This allows authenticated non-root users to perform unautho...

PT-2026-110148

Name of the Vulnerable Software and Affected Versions Vearch versions 3.5.2 through 3.5.9 Description An incorrect authorization issue exists in the HasPermissionForResources function. This flaw allows the system to ignore stored ReadOnly or None privilege levels for resources assigned to a role...