Incorrect Authorization in Vearch Allows Privilege Escalation to Cluster Admin

Executive Summary

Vearch versions 3.5.2 through 3.5.9 have an authorization flaw in Role.HasPermissionForResources. The system incorrectly ignores stored ReadOnly or None privilege levels for resources assigned to a role. This allows authenticated non-root users to bypass intended restrictions and perform unauthorized actions such as upserting or deleting documents, or escalating their role privileges to WriteRead or higher.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check Vearch versions between 3.5.2 and 3.5.9 for unauthorized privilege escalation attempts. Review role permissions and audit logs for non-root users performing write operations despite ReadOnly or None privileges. Inspect the Role.HasPermissionForResources function logic for incorrect privilege checks.

Useful 0 Not Useful 0

Impact Analysis

If you use Vearch 3.5.2 to 3.5.9, an attacker with basic authenticated access could manipulate data, delete records, or gain elevated privileges within your cluster. This could lead to data corruption, unauthorized access to sensitive information, or full administrative control over the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized data access, modification, or deletion. GDPR requires protecting personal data integrity and access controls, while HIPAA mandates strict access controls for protected health information. Exploitation could result in data breaches, unauthorized disclosures, or failure to maintain audit trails.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Vearch to a version beyond 3.5.9 where the authorization vulnerability is fixed. Review role permissions to ensure no unauthorized privilege escalation exists. Restrict non-root user access to sensitive operations until patched.

Useful 0 Not Useful 0