Vearch
Monthly
Incorrect authorization in Vearch 3.5.2 through 3.5.9 lets any authenticated non-root user who holds a role with ReadOnly or None resource privileges perform write operations that role should forbid. Because Role.HasPermissionForResources ignores the stored privilege level, such a user can upsert and delete documents and can call PUT /roles to grant their own role WriteRead privileges, escalating toward cluster-administrator access. Exploitation requires valid low-privilege credentials (PR:L) and is limited to the 3.5.2-3.5.9 range, so exposure is greatest in multi-tenant or shared deployments where untrusted users hold accounts; no public exploit code or confirmed active exploitation was identified at time of analysis.
Incorrect authorization in Vearch 3.5.2 through 3.5.9 lets any authenticated non-root user who holds a role with ReadOnly or None resource privileges perform write operations that role should forbid. Because Role.HasPermissionForResources ignores the stored privilege level, such a user can upsert and delete documents and can call PUT /roles to grant their own role WriteRead privileges, escalating toward cluster-administrator access. Exploitation requires valid low-privilege credentials (PR:L) and is limited to the 3.5.2-3.5.9 range, so exposure is greatest in multi-tenant or shared deployments where untrusted users hold accounts; no public exploit code or confirmed active exploitation was identified at time of analysis.