Weaviate versions prior to 1.38.0 fail to confirm that a principal assigning a role possesses the same or lower permissions as the role being granted. The assignment endpoints in the RBAC system allow a caller with only the "assign_and_revoke_users" or "assign_and_revoke_groups" permission to attach the built‑in admin role—or any high‑privilege custom role—to another user or group. This bypasses the hierarchy that ordinarily limits granted permissions, enabling an attacker to acquire full administrative control of the database. The weakness is catalogued as CWE-266, Privilege Escalation.

All deployments of the Weaviate database running any release before version 1.38.0. The affected product is Weaviate by Weaviate. Any user interacting with the role‑assignment endpoints on these releases could be susceptible.

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score is less than 1 %, implying a low but non‑zero probability of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. Exploitation would occur remotely via the REST API; an authenticated attacker who holds either the "assign_and_revoke_users" or "assign_and_revoke_groups" permission can assign a high‑privilege role to themselves or others, thereby gaining administrative rights over the entire system.