Weaviate before 1.38.0 does not verify that a principal performing an RBAC role assignment holds the permissions granted by the assigned role. (CVE-2026-59093)
Weaviate before 1.38.0 does not verify that a principal performing an RBAC role assignment holds the permissions granted by the assigned role. The assignRoleToUser and assignRoleToGroup handlers (POST /authz/users/{id}/assign and /authz/groups/{id}/assign) authorize only that the caller may assign roles to the target user or group, not the permissions contained in the assigned roles, unlike role creation which enforces that a user can only create roles with permissions less than or equal to its own. A user holding only the delegated assign_and_revoke_users or assign_and_revoke_groups permission can assign the built-in admin role, or any high-privilege custom role, to itself or others, escalating to full administrative control of the database.
AI Analysis
Technical Summary
In Weaviate versions prior to 1.38.0, the assignRoleToUser and assignRoleToGroup API handlers authorize only that the caller may assign roles to a target user or group, but do not verify that the caller possesses the permissions contained in the assigned roles. Unlike role creation, which enforces permission constraints, this flaw allows a user with only delegated assign_and_revoke_users or assign_and_revoke_groups permissions to assign highly privileged roles, including the built-in admin role, to themselves or others. This leads to privilege escalation and potential full administrative control over the database. The vulnerability is tracked as CVE-2026-59093 and categorized under CWE-266 (Incorrect Privilege Assignment).
Potential Impact
An attacker with limited delegated permissions related to user or group role assignments can escalate their privileges to full administrative control by assigning high-privilege roles, including the built-in admin role, to themselves or others. This compromises the integrity and security of the Weaviate database, potentially allowing unauthorized access and control over sensitive data and operations.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the assign_and_revoke_users and assign_and_revoke_groups permissions to trusted administrators only, and monitor role assignments closely to detect unauthorized privilege escalations.
Weaviate before 1.38.0 does not verify that a principal performing an RBAC role assignment holds the permissions granted by the assigned role. (CVE-2026-59093)
Description
Weaviate before 1.38.0 does not verify that a principal performing an RBAC role assignment holds the permissions granted by the assigned role. The assignRoleToUser and assignRoleToGroup handlers (POST /authz/users/{id}/assign and /authz/groups/{id}/assign) authorize only that the caller may assign roles to the target user or group, not the permissions contained in the assigned roles, unlike role creation which enforces that a user can only create roles with permissions less than or equal to its own. A user holding only the delegated assign_and_revoke_users or assign_and_revoke_groups permission can assign the built-in admin role, or any high-privilege custom role, to itself or others, escalating to full administrative control of the database.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In Weaviate versions prior to 1.38.0, the assignRoleToUser and assignRoleToGroup API handlers authorize only that the caller may assign roles to a target user or group, but do not verify that the caller possesses the permissions contained in the assigned roles. Unlike role creation, which enforces permission constraints, this flaw allows a user with only delegated assign_and_revoke_users or assign_and_revoke_groups permissions to assign highly privileged roles, including the built-in admin role, to themselves or others. This leads to privilege escalation and potential full administrative control over the database. The vulnerability is tracked as CVE-2026-59093 and categorized under CWE-266 (Incorrect Privilege Assignment).
Potential Impact
An attacker with limited delegated permissions related to user or group role assignments can escalate their privileges to full administrative control by assigning high-privilege roles, including the built-in admin role, to themselves or others. This compromises the integrity and security of the Weaviate database, potentially allowing unauthorized access and control over sensitive data and operations.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the assign_and_revoke_users and assign_and_revoke_groups permissions to trusted administrators only, and monitor role assignments closely to detect unauthorized privilege escalations.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-667j-56pf-pq9c
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-59093"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a46eca727e9c7971943a48b
Added to database: 07/02/2026, 22:56:39 UTC
Last enriched: 07/02/2026, 23:00:34 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 75
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.