
We found results for “”
CVE-2025-49011
Good to know:

Date: June 6, 2025
SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected. Version 1.44.2 fixes the issue. As a workaround, do not use caveats in the schema over an arrow’ed relation.
Severity Score
Related Resources (6)
Severity Score
Weakness Type (CWE)
Improperly Implemented Security Check for Standard
CWE-358Top Fix

Upgrade Version
Upgrade to version github.com/authzed/spicedb - v1.44.2;https://github.com/authzed/spicedb.git - v1.44.2
CVSS v3.1
Base Score: |
|
---|---|
Attack Vector (AV): | NETWORK |
Attack Complexity (AC): | HIGH |
Privileges Required (PR): | NONE |
User Interaction (UI): | NONE |
Scope (S): | UNCHANGED |
Confidentiality (C): | NONE |
Integrity (I): | LOW |
Availability (A): | NONE |