PT-2026-55294 · Weaviate · Weaviate
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Weaviate versions prior to 1.38.0
Description
An issue exists where the system fails to verify if a principal performing a Role-Based Access Control (RBAC) role assignment possesses the permissions granted by the role being assigned. While role creation correctly ensures a user can only create roles with permissions less than or equal to their own, the
assignRoleToUser and assignRoleToGroup handlers do not enforce this check. Consequently, a user with only the delegated assign and revoke users or assign and revoke groups permissions can assign the built-in admin role or any high-privilege custom role to themselves or others, leading to full administrative control of the database. This affects the following API endpoints:- '/authz/users/{id}/assign'
- '/authz/groups/{id}/assign'
Recommendations
Update to version 1.38.0.
Exploit
Fix
LPE
Incorrect Privilege Assignment
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Weaviate