In Weaviate versions prior to 1.38.0, the assignRoleToUser and assignRoleToGroup API handlers authorize only that the caller may assign roles to a target user or group, but do not verify that the caller possesses the permissions contained in the assigned roles. Unlike role creation, which enforces permission constraints, this flaw allows a user with only delegated assign_and_revoke_users or assign_and_revoke_groups permissions to assign highly privileged roles, including the built-in admin role, to themselves or others. This leads to privilege escalation and potential full administrative control over the database. The vulnerability is tracked as CVE-2026-59093 and categorized under CWE-266 (Incorrect Privilege Assignment).

An attacker with limited delegated permissions related to user or group role assignments can escalate their privileges to full administrative control by assigning high-privilege roles, including the built-in admin role, to themselves or others. This compromises the integrity and security of the Weaviate database, potentially allowing unauthorized access and control over sensitive data and operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the assign_and_revoke_users and assign_and_revoke_groups permissions to trusted administrators only, and monitor role assignments closely to detect unauthorized privilege escalations.