CVE-2026-59093: Weaviate RBAC role assignment without permission check on assigned roles

Summary

Weaviate versions before 1.38.0 fail to check whether a principal assigning an RBAC role actually holds the permissions that role grants. The assignRoleToUser and assignRoleToGroup handlers (POST /authz/users/{id}/assign and /authz/groups/{id}/assign) only verify the caller may assign roles, unlike role creation, which limits users to permissions they already hold. A user with only assign_and_revoke_users or assign_and_revoke_groups can assign the built-in admin role or any high-privilege custom role to itself or others, gaining full administrative control of the database.

Mitigation

Fixed in 1.38.0.

Related items

• MediumCVE-2026-108759: mistral.rs sandbox escape via symlinks in mistralrs-code-execSimilar attack · NVD/CVE Database
• MediumCVE-2026-108575: BerriAI LiteLLM improper authorization in secret resolution via api_keySimilar attack · NVD/CVE Database
• MediumCVE-2026-108574: BerriAI LiteLLM authorization bypass in session spend log view via session_idSimilar attack · NVD/CVE Database
• MediumCVE-2026-108670: JeecgBoot missing authorization in AiragPromptsControllerSimilar attack · NVD/CVE Database
• MediumCVE-2026-108600: open-multi-agent link following flaw in file_write tool sandboxSimilar attack · NVD/CVE Database