CVE-2025-49011
SpiceDB checks involving relations with caveats can result in no permission when permission is expected
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
SpiceDB checks involving relations with caveats can result in no permission when permission is expected
SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected. Version 1.44.2 fixes the issue. As a workaround, do not use caveats in the schema over an arrow’ed relation.
Reserved 2025-05-29 | Published 2025-06-06 | Updated 2025-06-06 | Assigner GitHub_MCWE-358: Improperly Implemented Security Check for Standard
github.com/...picedb/security/advisories/GHSA-cwwm-hr97-qfxm
github.com/...ommit/fe8dd9f491f6975b3408c401e413a530eb181a67
github.com/authzed/spicedb/releases/tag/v1.44.2
Support options
