The flaw lies in Vearch’s Role.HasPermissionForResources routine, which mistakenly ignores the ReadOnly or None privilege assignments applied to resources in a role. Consequently, an authenticated non‑root user can perform upsert and delete operations on data that should be protected, and can exploit the /roles API to grant their role ReadWrite privileges. This escalates the user’s authority toward cluster administrator level, revealing a clear privilege escalation path (CWE‑863).

All Vearch releases from version 3.5.2 through 3.5.9 are vulnerable. The vulnerability affects the core server components that handle role management and document access, including the API endpoints for modifying roles and data. Any deployment of these versions without a subsequent fix is at risk.

The CVSS score of 8.7 indicates high severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV. Attackers must have authenticated access, which could be local or remote depending on how the cluster is exposed. While no public exploits are documented, the ability to bypass authorization checks makes the flaw compelling for attackers targeting Vearch clusters.