Weaviate CVE-2026-59093

Exploitation requires an authenticated principal (CVSS PR:L) that already holds the delegated assign_and_revoke_users or assign_and_revoke_groups permission in Weaviate's RBAC, and requires that RBAC authorization be enabled on the instance. Given that, the attacker calls POST /authz/users/{id}/assign or POST /authz/groups/{id}/assign to assign the built-in admin role or any high-privilege custom role to itself or another controlled account. Limiting factors: the caller must first possess one of those specific delegated assign/revoke permissions (so it is not exploitable by an unauthenticated or zero-permission user), RBAC must be in use, and a target high-privilege role must exist to assign; there is no user-interaction or non-default-platform requirement beyond having delegated administration configured.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, base 8.7) accurately captures the risk: network-reachable, low complexity, no user interaction, but requiring low-level authenticated privileges (PR:L) - specifically an account that has already been granted the delegated assign/revoke capability. High impact across confidentiality, integrity, and availability is justified because the outcome is full admin control of the database. No EPSS score, KEV listing, or POC was provided, so real-world exploitation frequency cannot be quantified from the input; the practical risk is concentrated in multi-tenant or delegated-administration Weaviate deployments where assign/revoke permissions are handed to non-admin operators. This is a genuine, high-value escalation rather than a high-CVSS-but-low-real-risk theoretical issue, but exploitation is gated on an attacker first obtaining the delegated assign permission - meaning the effective blast radius depends heavily on how loosely those permissions are distributed. Note the CVSS 4.0 subsequent-system metrics are N (SC:N/SI:N/SA:N), consistent with escalation staying within the same database authority rather than crossing into other systems.

An operator or compromised service account that was intentionally granted only the delegated assign_and_revoke_users permission - meant to let it manage which users hold which existing roles - sends a POST /authz/users/{id}/assign request assigning the built-in admin role to its own user ID. Because the handler never checks whether the caller itself holds admin-level permissions, the assignment succeeds and the account is instantly promoted to full administrative control over the vector database and all its data. No public POC was provided, but the attack is a single authenticated API call with low complexity and no user interaction.