CVE-2025-49011
published 2025-06-06CVE-2025-49011: SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats…
PriorityP428medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.27%
18.0th percentile
SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected. Version 1.44.2 fixes the issue. As a workaround, do not use caveats in the schema over an arrow’ed relation.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| authzed | spicedb | < 1.44.2 | 1.44.2 |
| github.com | authzed_spicedb | >= 0 < 1.44.2 | 1.44.2 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
SpiceDB checks involving relations with caveats can result in no permission when permission is expected in github.com/authzed/spicedb
osv·2025-06-10
CVE-2025-49011 SpiceDB checks involving relations with caveats can result in no permission when permission is expected in github.com/authzed/spicedb
SpiceDB checks involving relations with caveats can result in no permission when permission is expected in github.com/authzed/spicedb
SpiceDB checks involving relations with caveats can result in no permission when permission is expected in github.com/authzed/spicedb
OSV
SpiceDB checks involving relations with caveats can result in no permission when permission is expected
osv·2025-06-06
CVE-2025-49011 [LOW] SpiceDB checks involving relations with caveats can result in no permission when permission is expected
SpiceDB checks involving relations with caveats can result in no permission when permission is expected
### Impact
On schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected.
For example, given this schema:
```
definition user {}
definition office {
relation parent: office
relation manager: user
permission read = manager + parent->read
}
definition group {
relation parent: office
permission read = parent->read
}
definition document {
relation owner: group with equals
permission read = owner->read
}
caveat equals(actual string, required string) {
actual == required
}
```
and these relationships
GHSA
SpiceDB checks involving relations with caveats can result in no permission when permission is expected
ghsa·2025-06-06
CVE-2025-49011 [LOW] CWE-358 SpiceDB checks involving relations with caveats can result in no permission when permission is expected
SpiceDB checks involving relations with caveats can result in no permission when permission is expected
### Impact
On schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected.
For example, given this schema:
```
definition user {}
definition office {
relation parent: office
relation manager: user
permission read = manager + parent->read
}
definition group {
relation parent: office
permission read = parent->read
}
definition document {
relation owner: group with equals
permission read = owner->read
}
caveat equals(actual string, required string) {
actual == required
}
```
and these relationships
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-06-06
Published