https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sun, 11 Oct 2026 22:38:02 +0000 https://vulnerability.circl.lu/sighting/5b35c28f-63b6-424d-b43a-b9894aa68fb0/export {"uuid": "5b35c28f-63b6-424d-b43a-b9894aa68fb0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108746", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422401047715506", "content": "CVE-2026-108746 Vearch 3.5.2 through 3.5.9 Incorrect Authorization via Role.HasPermissionForResources Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege levels for resources listed in a role. Authenticated non-root users can upsert and delete documents with read-only access, or call PUT /roles to grant their role WriteRead privileges, escalating toward cluster administrator access.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108746https://hackmd.io/@haind/vearch-rbac-privilege-level-ignored-authz-bypasshttps://github.com/vearch/vearch/blob/bae78b189ff0ab1d8ac659c6acaeeb5f630db33f/internal/entity/user.go#L300-L313https://github.com/vearch/vearch/blob/bae78b189ff0ab1d8ac659c6acaeeb5f630db33f/internal/master/services/role_service.go#L180-L229https://github.com/vearch/vearchhttps://www.vulncheck.com/advisories/vearch-3.5.2-through-3.5.9-incorrect-authorization-via-role-haspermissionforresources#Vearch #vearch#CVE_2026_108746#bot", "creation_timestamp": "2026-10-11T13:00:49.358132Z"} {"uuid": "5b35c28f-63b6-424d-b43a-b9894aa68fb0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108746", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422401047715506", "content": "CVE-2026-108746 Vearch 3.5.2 through 3.5.9 Incorrect Authorization via Role.HasPermissionForResources Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege levels for resources listed in a role. Authenticated non-root users can upsert and delete documents with read-only access, or call PUT /roles to grant their role WriteRead privileges, escalating toward cluster administrator access.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108746https://hackmd.io/@haind/vearch-rbac-privilege-level-ignored-authz-bypasshttps://github.com/vearch/vearch/blob/bae78b189ff0ab1d8ac659c6acaeeb5f630db33f/internal/entity/user.go#L300-L313https://github.com/vearch/vearch/blob/bae78b189ff0ab1d8ac659c6acaeeb5f630db33f/internal/master/services/role_service.go#L180-L229https://github.com/vearch/vearchhttps://www.vulncheck.com/advisories/vearch-3.5.2-through-3.5.9-incorrect-authorization-via-role-haspermissionforresources#Vearch #vearch#CVE_2026_108746#bot", "creation_timestamp": "2026-10-11T13:00:49.358132Z"} https://vulnerability.circl.lu/sighting/5b35c28f-63b6-424d-b43a-b9894aa68fb0/export Sun, 11 Oct 2026 13:00:49 +0000