Weaviate versions earlier than 1.38.0 allow a principal to assign RBAC roles without confirming that the principal has the same or greater permissions as the roles being granted. The assignRoleToUser and assignRoleToGroup endpoints only check that the caller can assign roles to a user or group, but do not verify that the caller is authorized for every permission contained in the selected role. This flaw means a user who holds only the "assign_and_revoke_users" or "assign_and_revoke_groups" permission can elevate themselves or another user to the built‑in admin role or any high‑privilege custom role, granting full administrative control over the entire database. The weakness is catalogued as CWE‑266, Privilege Escalation.

All deployments of the Weaviate database using any release before version 1.38.0. The affected product is Weaviate by Weaviate. Any user interacting with the role‑assignment API endpoints on these releases could be susceptible.

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score is less than 1 %, implying a low but non‑zero probability of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. Exploitation would occur remotely via the REST API; an authenticated attacker who holds either the "assign_and_revoke_users" or "assign_and_revoke_groups" permission can assign a high‑privilege role to themselves or others, thereby gaining administrative rights over the entire system.