Vulnerability · Published Jun 6, 2025 · Assigned by GitHub_M

CVE-2025-49011SpiceDB checks involving relations with caveats can result in no permission when permission is expected

Low 3.7

In plain English

A low-severity security flaw in spicedb from authzed. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.3%top 73.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected. Version 1.44.2 fixes the issue. As a workaround, do not use caveats in the schema over an arrow’ed relation.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/authzed/spicedb	1.44.2	GHSA-cwwm-hr97-qfxm
Go	github.com/authzed/spicedb	1.44.2	GO-2025-3744

Affected products (as reported)

Vendor	Product	Versions
authzed	spicedb	< 1.44.2

Weakness: CWE-358 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/authzed/spicedb/security/advisories/GHSA-cwwm-hr97-qfxm x_refsource_CONFIRM
https://github.com/authzed/spicedb/commit/fe8dd9f491f6975b3408c401e413a530eb181a67 x_refsource_MISC
https://github.com/authzed/spicedb/releases/tag/v1.44.2 x_refsource_MISC