ZillizTech DeepSearcher Collection Routing Authorization Bypass (Privilege Escalation via Unauthorized Access to Restricted Collections)

Vulnerability Overview Title: Collection routing ignores caller authorization context #267 Description: accepts arbitrary keyword arguments but does not use the caller's authorization context when selecting a vector database collection. Routing is based solely on the query and a globally listed set of collection names/descriptions. The downstream RAG process directly searches the selected collection. If DeepSearcher is deployed as a shared service, different users, tenants, roles, or permission scopes can access different collections. Two callers with different authorization scopes may be routed to the same restricted collection. This could result in the retrieval of results from collections that the caller is not authorized to search. Impact Environment: Linux Dependencies: Project installed via checkout from the current repository Version: repository on the current branch Security Impact: Unauthorized users may retrieve or summarize content from collections they are not permitted to access if the application relies on DeepSearcher routing to restrict accessible collections. Remediation Expected Behavior: Collection routing should not select a collection outside the caller's authorized collection set. If the application provides the authorization context via or other request contexts, that context must be enforced prior to retrieval. At a minimum, the selected collection must intersect with the caller's authorized collection set before is called. Recommendation: If DeepSearcher does not intend to implement authorization, the documentation should state that collection-level access control must be enforced by the application or the vector database layer before exposing the RAG endpoint to multiple users. POC Code Actual Behavior may include because authorization-related fields are ignored. Environment Information OS: Linux Dependencies: Project installed via checkout from the current repository Version: repository on the current branch Additional Context This issue is most relevant when deploying DeepSearcher as a multi-tenant service. The repository does not appear to define first-class models for , , , or ; therefore, this issue is conditional in deployments that use collections as access control boundaries.

Goal Reached Thanks to every supporter — we hit 100%!

ZillizTech DeepSearcher Collection Routing Authorization Bypass (Privilege Escalation via Unauthorized Access to Restricted Collections)

More from this source