Low severityNVD Advisory· Published Jun 6, 2025· Updated Jun 6, 2025
SpiceDB checks involving relations with caveats can result in no permission when permission is expected
CVE-2025-49011
Description
SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected. Version 1.44.2 fixes the issue. As a workaround, do not use caveats in the schema over an arrow’ed relation.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/authzed/spicedbGo | < 1.44.2 | 1.44.2 |
Affected products
3- ghsa-coords2 versionspkg:golang/github.com/authzed/spicedbpkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Tumbleweed
< 1.44.2+ 1 more
- (no CPE)range: < 1.44.2
- (no CPE)range: < 0.0.20250612T141001-1.1
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-cwwm-hr97-qfxmghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-49011ghsaADVISORY
- github.com/authzed/spicedb/commit/fe8dd9f491f6975b3408c401e413a530eb181a67ghsax_refsource_MISCWEB
- github.com/authzed/spicedb/releases/tag/v1.44.2ghsax_refsource_MISCWEB
- github.com/authzed/spicedb/security/advisories/GHSA-cwwm-hr97-qfxmghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.