CVE-2026-59093Patch(weaviate / weaviate)

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch weaviate weaviate systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Weaviate before 1.38.0 does not verify that a principal performing an RBAC role assignment holds the permissions granted by the assigned role. The assignRoleToUser and assignRoleToGroup handlers (POST /authz/users/{id}/assign and /authz/groups/{id}/assign) authorize only that the caller may assign roles to the target user or group, not the permissions contained in the assigned roles, unlike role creation which enforces that a user can only create roles with permissions less than or equal to its own. A user holding only the delegated assign_and_revoke_users or assign_and_revoke_groups permission can assign the built-in admin role, or any high-privilege custom role, to itself or others, escalating to full administrative control of the database.

weaviate CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

Other references

https://github.com/weaviate/weaviate/releases/tag/v1.38.0

Weakness type (CWE)

CWE-266

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

weaviate

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 1 classified signal
Peaked 1d ago at 1 mentions (2026-07-03); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

weaviate

Products

weaviate

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

Patch

150.0%

Disclosure

150.0%

Classification over time

Date	Total	Labels

2026-07-03	1	Patch1
2026-08-12	1	Disclosure1

Full discourse2 posts

Joey Romaine 🇺🇸 |=★=|@Tank23x050d
Disclosure
Another reminder that trust is earned, not assumed. CVE-2026-59093. Weaviate before 1.38.0 does not verify that a principal performing an RBAC role assignment holds the permissions... The best defense is the one you set up before you needed it.
Post summary
The message highlights that Weaviate versions earlier than 1.38.0 lack a permission check for RBAC role assignments, implying a potential privilege‑escalation vulnerability in that product.
0000050
356 followersView on X
Upwind Security MDR@UpwindMDR91d
Patch
🚨High - Weaviate RBAC Privilege Escalation via Unchecked Role Assignment (CVE-2026-59093) Weaviate's RBAC assignRoleToUser / assignRoleToGroup handlers verify only that the caller may assign roles to the target - not that the caller holds the permissions contained in the assigned role. Role creation correctly enforces "permissions ≤ your own," but role assignment does not. So a user with only the delegated assign_and_revoke_users or assign_and_revoke_groups permission can assign the built-in admin role (or any high-privilege custom role) to itself or others, escalating to full administrative control of the vector database. Exploitation needs only that low-privilege delegated permission and no user interaction. 👉Upgrade Weaviate to 1.38.0.
Post summary
Weaviate has a high‑severity RBAC privilege escalation flaw (CVE‑2026‑59093) where users with limited permissions can grant admin rights; the issue is fixed in version 1.38.0, and no active exploitation or PoC was reported.
00000110
236 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	weaviate	weaviate	-	-	-

Explore more

Back to dashboard weaviate CVEs weaviate vulnerabilities