CVE-2026-59093: Weaviate RBAC Privilege Escalation to Admin (8.8 HIGH)

Technical summary

CVE-2026-59093 is a broken access control vulnerability (CWE-266) in Weaviate's RBAC implementation. The assignRoleToUser and assignRoleToGroup handlers (POST /authz/users/{id}/assign and /authz/groups/{id}/assign endpoints) perform authorization checks on whether a caller may assign roles to a target principal, but they do not validate that the assigned role's permissions are less than or equal to the caller's own permissions. This contrasts with role creation logic, which correctly enforces a permission ceiling. An authenticated user holding only the delegated assign_and_revoke_users or assign_and_revoke_groups permission can invoke these endpoints to assign high-privilege roles (including the built-in admin role) to themselves or other principals, bypassing the intended permission model and achieving full administrative access to the database.

Business impact

An attacker with minimal RBAC permissions can escalate to database administrator privileges, gaining the ability to read, modify, or delete all data; alter access controls; and disrupt service availability. In multi-tenant environments or organizations using Weaviate for sensitive data, this creates a direct path to complete data compromise and loss of confidentiality, integrity, and availability.

Affected systems

Weaviate versions prior to 1.38.0 are affected. Organizations running Weaviate with RBAC enabled and users granted assign_and_revoke_users or assign_and_revoke_groups permissions are at immediate risk.

Exploitability

Exploitability is high. The vulnerability requires only network access and valid authentication credentials (specifically, an account with role-assignment permissions). No user interaction is required, and the attack is trivial to execute—a single API call can escalate privileges. The CVSS 3.1 score of 8.8 (HIGH) reflects the low complexity (L), low privileges required (L), and network-accessible attack vector. No known public exploit is documented in the KEV catalog at this time.

Remediation

Upgrade Weaviate to version 1.38.0 or later. Before patching, apply compensating controls: restrict the assign_and_revoke_users and assign_and_revoke_groups permissions to highly trusted administrators only, and conduct an access control audit to identify accounts that hold these permissions. If RBAC is not in use, ensure it remains disabled in configuration.

Patch guidance

Vendors should verify the exact patched version against the official Weaviate release notes and security advisories. Version 1.38.0 is cited as the corrected release in the vulnerability data. Test patches in a non-production environment first to ensure no regression in role-assignment workflows. Apply the update during a maintenance window due to potential service restarts.

Detection guidance

Monitor Weaviate logs for suspicious POST requests to /authz/users/{id}/assign or /authz/groups/{id}/assign endpoints, particularly those assigning admin roles or other high-privilege roles to accounts that should not hold them. Check for role assignments by low-privilege service accounts. Conduct a periodic audit of RBAC role membership to identify unauthorized escalations. Network detection of repeated failed or anomalous role-assignment attempts may indicate reconnaissance or attack attempts.

Why prioritize this

This vulnerability merits immediate attention because it provides a direct, unauthenticated-to-admin privilege escalation path that requires no exploitation complexity. The impact scope is critical—full database compromise—and the attack surface is broad (any user with assign_and_revoke permissions). Organizations should prioritize patching or applying compensating controls within days, not weeks.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: (1) network-accessible attack vector requiring no special conditions; (2) low privilege and complexity requirements; (3) high impact across confidentiality, integrity, and availability. The vulnerability is not in the KEV catalog, indicating no known active exploitation at the time of publication, but the ease of exploitation and severity of impact justify treating this as a critical issue for Weaviate operators.

Frequently asked questions