TI-2026-70724 CVE-2026-108746 · GHSA-73v4-h56h-crx9
Incorrect authorization in Vearch lets users bypass read-only roles
Priority HIGH 73
Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege levels for resources listed in a role.