Weaviate security release - Medium severity fix for a cross-collection vector disclosure in nearObject (CVE pending assignment)

Weaviate v1.39.3 and later fix a medium severity authorization flaw in GraphQL's nearObject search operator. The flaw could let a user reconstruct an object's vector from a collection they didn't have permission to read.

Weaviate says Cloud customers and Marketplace customers on AWS, Azure and GCP have already been patched. Its teams are coordinating upgrades with Weaviate Dedicated customers where appropriate.

The security release says a CVE has been requested and is pending assignment. The flaw exposed information through search-result distances, rather than returning the protected object or its properties directly.