CVE-2025-49011

SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected. Version 1.44.2 fixes the issue. As a workaround, do not use caveats in the schema over an arrow’ed relation.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/authzed/spicedb/commit/fe8dd9f491f6975b3408c401e413a530eb181a67	Patch
https://github.com/authzed/spicedb/releases/tag/v1.44.2	Release Notes
https://github.com/authzed/spicedb/security/advisories/GHSA-cwwm-hr97-qfxm	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:authzed:spicedb:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-06-06 18:15

Updated : 2025-09-04 16:48

NVD link : CVE-2025-49011

Mitre link : CVE-2025-49011

CVE.ORG link : CVE-2025-49011

JSON object : View

Products Affected

authzed

spicedb

CWE

CWE-358

Improperly Implemented Security Check for Standard

{"id": "CVE-2025-49011", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2025-06-06T18:15:35.497", "references": [{"url": "https://github.com/authzed/spicedb/commit/fe8dd9f491f6975b3408c401e413a530eb181a67", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/authzed/spicedb/releases/tag/v1.44.2", "tags": ["Release Notes"], "source": "[email protected]"}, {"url": "https://github.com/authzed/spicedb/security/advisories/GHSA-cwwm-hr97-qfxm", "tags": ["Patch", "Third Party Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-358"}]}], "descriptions": [{"lang": "en", "value": "SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats on the arrow\u2019ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected. Version 1.44.2 fixes the issue. As a workaround, do not use caveats in the schema over an arrow\u2019ed relation."}, {"lang": "es", "value": "SpiceDB es una base de datos de c\u00f3digo abierto para almacenar y consultar datos de autorizaci\u00f3n detallados. Antes de la versi\u00f3n 1.44.2, en esquemas con flechas y advertencias en la relaci\u00f3n con flechas, cuando la ruta para resolver una solicitud CheckPermission implica la evaluaci\u00f3n de varias ramas con advertencias, las solicitudes pod\u00edan devolver una respuesta negativa cuando se esperaba una positiva. La versi\u00f3n 1.44.2 soluciona este problema. Como soluci\u00f3n alternativa, no utilice advertencias en el esquema sobre una relaci\u00f3n con flechas."}], "lastModified": "2025-09-04T16:48:00.090", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:authzed:spicedb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "98C0C4A9-0BC1-4A5A-BCEE-E33D1FD3FE8A", "versionEndExcluding": "1.44.2"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}