EUVD-2026-96911

Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege levels for resources listed in a role. Authenticated non-root users can upsert and delete documents with read-only access, or call PUT /rol...

CVE-2026-108746 Vearch 3.5.2 through 3.5.9 Incorrect Authorization via Role.HasPermissionForResources

Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege levels for resources listed in a role. Authenticated non-root users can upsert and delete documents with read-only access, or call PUT /rol...

CVE-2026-108746

Vearch versions 3.5.2 through 3.5.9 are vulnerable to an incorrect authorization flaw in Role.HasPermissionForResources. The root cause is that the system ignores stored ReadOnly or None privilege levels for resources included in a role. This allows authenticated non-root users to perform unautho...