CVE-2025-49011: low-severity vulnerability in authzed spicedb
SpiceDB checks involving relations with caveats can result in no permission when permission is expected
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 3.7epss 0.3%
SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected. Version 1.44.2 fixes the issue. As a workaround, do not use caveats in the schema over an arrow’ed relation.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
authzed · spicedbRelated CVEs — authzed spicedb
In the same product, most dangerous first.
CVE-2022-21646HIGHLookup operations do not take into account wildcards in SpiceDBEPSS 1.3%CVE-2023-29193HIGHSpiceDB binding metrics port to untrusted networks and can leak command-line flagsEPSS 0.8%CVE-2024-32001LOWSpiceDB: LookupSubjects may return partial results if a specific kind of relation is usedEPSS 0.6%CVE-2024-27101HIGHInteger overflow in chunking helper causes dispatching to miss elements or panicEPSS 0.5%CVE-2023-35930LOWLookupResources may return partial results in spicedbEPSS 0.4%CVE-2023-46255MEDIUM`SPICEDB_DATASTORE_CONN_URI` is leaked when URI cannot be parsedEPSS 0.4%