CVE-2025-49011

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-49011
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49011.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-49011
Aliases
Downstream
Related
Published
2025-06-06T17:36:21Z
Modified
2026-10-21T02:30:28Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
SpiceDB checks involving relations with caveats can result in no permission when permission is expected
Details

SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected. Version 1.44.2 fixes the issue. As a workaround, do not use caveats in the schema over an arrow’ed relation.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-358"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49011.json"
}
References

Affected packages

Git / github.com/authzed/spicedb

Affected ranges

Type
GIT
Repo
https://github.com/authzed/spicedb
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
67779dc3b2ba54c1763c421263fe23c18abac8a2
Fixed
fe8dd9f491f6975b3408c401e413a530eb181a67
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:authzed:spicedb:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "1.44.2"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "fe8dd9f491f6975b3408c401e413a530eb181a67"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v1.44.2",
            "range":  [
                {
                    "fixed":  "67779dc3b2ba54c1763c421263fe23c18abac8a2"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

v0.*
v0.0.1
v0.0.2
v0.0.3
v1.*
v1.0.0
v1.1.0
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.14.1
v1.15.0
v1.16.0
v1.16.1
v1.16.2
v1.17.0
v1.18.1
v1.19.0
v1.2.0
v1.21.0
v1.21.0-rc1
v1.22.0
v1.22.0-rc1
v1.22.0-rc2
v1.22.0-rc4
v1.22.0-rc5
v1.22.0-rc6
v1.22.0-rc7
v1.22.0-rc8
v1.22.1
v1.22.1-rc1
v1.22.2
v1.23.0
v1.23.0-rc1
v1.23.0-rc2
v1.23.0-rc3
v1.23.0-rc4
v1.23.1
v1.23.1-rc1
v1.24.0
v1.24.0-rc1
v1.24.0-rc2
v1.24.0-rc3
v1.25.0
v1.25.0-rc1
v1.25.0-rc2
v1.25.0-rc3
v1.25.0-rc4
v1.26.0
v1.26.0-rc1
v1.26.0-rc2
v1.27.0
v1.27.0-rc1
v1.27.1-rc1
v1.28.0
v1.28.0-rc1
v1.29.0
v1.29.1
v1.29.1-rc1
v1.3.0
v1.30.0
v1.31.0
v1.32.0
v1.33.0
v1.34.0
v1.35.0
v1.35.1
v1.35.2
v1.35.3
v1.37.0
v1.38.0
v1.39.0
v1.4.0
v1.40.0
v1.40.1
v1.41.0
v1.42.0
v1.42.1
v1.43.0
v1.44.0
v1.5.0
v1.7.0
v1.7.1
v1.8.0
v1.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49011.json"