CVE-2025-49011

SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected. Version 1.44.2 fixes the issue. As a workaround, do not use caveats in the schema over an arrow’ed relation.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/authzed/spicedb/commit/fe8dd9f491f6975b3408c401e413a530eb181a67
https://github.com/authzed/spicedb/releases/tag/v1.44.2
https://github.com/authzed/spicedb/security/advisories/GHSA-cwwm-hr97-qfxm

Configurations

No configuration.

History

09 Jun 2025, 12:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-06-06 18:15

Updated : 2025-06-09 12:15

NVD link : CVE-2025-49011

Mitre link : CVE-2025-49011

CVE.ORG link : CVE-2025-49011

JSON object : View

Products Affected

No product.

CWE

CWE-358

Improperly Implemented Security Check for Standard

{"id": "CVE-2025-49011", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "published": "2025-06-06T18:15:35.497", "references": [{"url": "https://github.com/authzed/spicedb/commit/fe8dd9f491f6975b3408c401e413a530eb181a67", "source": "security-advisories@github.com"}, {"url": "https://github.com/authzed/spicedb/releases/tag/v1.44.2", "source": "security-advisories@github.com"}, {"url": "https://github.com/authzed/spicedb/security/advisories/GHSA-cwwm-hr97-qfxm", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-358"}]}], "descriptions": [{"lang": "en", "value": "SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats on the arrow\u2019ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected. Version 1.44.2 fixes the issue. As a workaround, do not use caveats in the schema over an arrow\u2019ed relation."}, {"lang": "es", "value": "SpiceDB es una base de datos de c\u00f3digo abierto para almacenar y consultar datos de autorizaci\u00f3n detallados. Antes de la versi\u00f3n 1.44.2, en esquemas con flechas y advertencias en la relaci\u00f3n con flechas, cuando la ruta para resolver una solicitud CheckPermission implica la evaluaci\u00f3n de varias ramas con advertencias, las solicitudes pod\u00edan devolver una respuesta negativa cuando se esperaba una positiva. La versi\u00f3n 1.44.2 soluciona este problema. Como soluci\u00f3n alternativa, no utilice advertencias en el esquema sobre una relaci\u00f3n con flechas."}], "lastModified": "2025-06-09T12:15:47.880", "sourceIdentifier": "security-advisories@github.com"}