# Weaviate security release - Medium severity fix for a cross-collection vector disclosure in nearObject (CVE pending assignment) By Steven Van · 2026-10-15 Intro​ With the release of Weaviate v1.39.3 and >, there is a fix for a medium severity authorization vulnerability in Weaviate's GraphQL nearObject… Weaviate · October 15, 2026 Intro​ With the release of Weaviate v1.39.3 and >, there is a fix for a medium severity authorization vulnerability in Weaviate's GraphQL nearObject search operator, where a user could read the vector of an object in a collection they do not have permission to read. A CVE has been requested from MITRE and is pending assignment; we will update this post with the CVE ID once it has been issued. As per our security policy, Weaviate customers running in Weaviate Cloud, and Marketplace customers on AWS, Azure and GCP have been patched seamlessly. Our Weaviate Enterprise Support customers have received early notification under embargo, and our customer-facing teams are working with Weaviate Dedicated customers to organize version upgrades where appropriate. Cross-collection vector disclosure via nearObject (CVE pending assignment)​ A nearObject search takes a beacon naming an existing object, loads that object's vector, and uses it as the search vector. Weaviate authorized the collection being searched, but did not authorize the collection named in the beacon. Where the two differed, the vector of the beacon target was loaded and used even if the caller had no read permission on it. The [Read the original release note →]() [Read Weaviate security release - Medium severity fix for a cross-collection vector disclosure in nearObject (CVE pending assignment) on Creators Toolbox]() --- Canonical source: https://creatorstoolbox.com/blog/weaviate-weaviate-security-release-medium-severity-fix-for-a-cross-collection