CVE-2026-59093 Details
Description
Weaviate before 1.38.0 does not verify that a principal performing an RBAC role assignment holds the permissions granted by the assigned role. The assignRoleToUser and assignRoleToGroup handlers (POST /authz/users/{id}/assign and /authz/groups/{id}/assign) authorize only that the caller may assign roles to the target user or group, not the permissions contained in the assigned roles, unlike role creation which enforces that a user can only create roles with permissions less than or equal to its own. A user holding only the delegated assign_and_revoke_users or assign_and_revoke_groups permission can assign the built-in admin role, or any high-privilege custom role, to itself or others, escalating to full administrative control of the database.
A vulnerability exists in Weaviate versions prior to 1.38.0, where the system fails to ensure that a principal assigning roles through the RBAC framework actually possesses the permissions associated with those roles. The issue is present in the 'assignRoleToUser' and 'assignRoleToGroup' handlers, which only verify the authority to assign roles, not the permissions those roles confer. This oversight allows users with limited permissions, such as 'assign_and_revoke_users' or 'assign_and_revoke_groups', to grant themselves or others high-privilege roles, including the built-in admin role, thereby gaining full administrative control over the database.
Users can update to Weaviate version 1.38.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/weaviate/weaviate/commit/2c75f6fb217631f7751c4b2a7d37a488cef13edb | [email protected] | Patch |
| https://github.com/weaviate/weaviate/pull/11493 | [email protected] | Issue TrackingPatch |
| https://github.com/weaviate/weaviate/releases/tag/v1.38.0 | [email protected] | ProductRelease Notes |
| https://www.vulncheck.com/advisories/weaviate-privilege-escalation-via-unchecked-permissions-in-rbac-role-assignment | [email protected] | PatchRelease NotesThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| weaviate weaviate | < 1.38.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jul 7, 2026 | Initial Analysis | [email protected] |
| Jul 6, 2026 | CVE Modified | CISA-ADP |
| Jul 2, 2026 | New CVE Received | [email protected] |