Weaviate RBAC Privilege Escalation via Role Assignment

Executive Summary

CVE-2026-59093 is a privilege escalation vulnerability in Weaviate versions before 1.38.0 related to its Role-Based Access Control (RBAC) system.

The vulnerability occurs because the system does not verify that a user assigning a role actually holds the permissions granted by that role. While the system checks if the caller is authorized to assign roles to users or groups, it fails to validate the permissions contained within the assigned roles.

This means a user with limited permissions, such as only having the ability to assign or revoke users or groups, can assign themselves or others high-privilege roles like the built-in admin role or any custom role with elevated permissions, effectively escalating their privileges to full administrative control over the database.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with limited permissions to escalate their privileges to full administrative control of the Weaviate database.

With administrative control, the attacker can access, modify, or delete sensitive data, change configurations, and potentially compromise the entire system.

Such unauthorized access and control can lead to data breaches, loss of data integrity, and disruption of services.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves improper permission checks in Weaviate's RBAC system, specifically in the role assignment handlers. Detection would involve monitoring or auditing role assignment activities, especially POST requests to /authz/users/{id}/assign and /authz/groups/{id}/assign endpoints.

You can detect potential exploitation by checking logs for role assignments where a user with limited permissions assigns themselves or others high-privilege roles such as the built-in admin role.

Suggested commands or methods include:

• Review Weaviate API access logs for POST requests to /authz/users/{id}/assign and /authz/groups/{id}/assign.
• Filter logs for role assignments where the assigned role is 'admin' or other high-privilege custom roles.
• Check if the caller's permissions include only assign_and_revoke_users or assign_and_revoke_groups but they assigned themselves or others higher privilege roles.
• Use audit tools or scripts to correlate user permissions with assigned roles to detect mismatches indicating privilege escalation.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade Weaviate to version 1.38.0 or later, where this vulnerability has been fixed by enforcing stricter permission checks during role assignments.

The fix ensures that users cannot assign roles with permissions they themselves do not possess, preventing privilege escalation.

Until the upgrade can be applied, consider restricting access to the role assignment endpoints (/authz/users/{id}/assign and /authz/groups/{id}/assign) to trusted administrators only.

Additionally, audit current role assignments and revoke any unauthorized high-privilege roles that may have been assigned improperly.

Useful 0 Not Useful 0