Threats affecting pkg:github/weaviate

Weaviate versions prior to 1.38.0 contain a privilege escalation vulnerability due to improper verification of permissions during RBAC role assignments. Specifically, users with limited assign_and_revoke_users or assign_and_revoke_groups permissions can assign themselves or others high-privilege roles, including the built-in admin role, without verifying that they hold the permissions contained in those roles. This flaw allows unauthorized escalation to full administrative control of the database.