CVE-2026-59093: Weaviate before 1.38.0 does not verify that a principal performing an RBAC role assignment holds the permissions granted

Weaviate versions before 1.38.0 have a security flaw in RBAC (role-based access control, a system that restricts what users can do based on assigned roles) where the system doesn't check if someone assigning a role to themselves or others actually has permission to grant those permissions. This means a user with limited permissions can assign themselves or others powerful admin roles, gaining full control of the database.