GHSA-4vrg-r928-h5vv

Source

https://github.com/advisories/GHSA-4vrg-r928-h5vv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-4vrg-r928-h5vv/GHSA-4vrg-r928-h5vv.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4vrg-r928-h5vv

Aliases

Published

2026-06-19T21:42:12Z

Modified

2026-06-25T18:56:25Z

Severity

3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected

Details

Impact

Under concurrency, CheckPermission and CheckBulkPermissions can return PERMISSIONSHIP_HAS_PERMISSION for a (resource, permission, subject) whose correct answer is PERMISSIONSHIP_CONDITIONAL_PERMISSION.

You are impacted if all of the following hold:

Your schema has a permission combining relations with an intersection or exclusion, where a subject reaches it through a caveated branch and a non-caveated branch. For example:

  definition user {}

  caveat some_caveat(somecondition int) { somecondition == 42 }

  definition document {
    relation reader: user | user with some_caveat
    relation writer: user
    relation banned: user
    permission has_permission = (reader & writer) - banned
  }

A subject reaches the permission via the caveated edge:

  document:firstdoc#reader@user:caveatedreader[some_caveat]
  document:firstdoc#writer@user:caveatedreader

Your workload issues LookupResources with a context request parameter, concurrently with CheckPermission/CheckBulkPermissions for the same subject/resource, and
The dispatch result cache is enabled.

When all of the above are true, there is an intermittent window in which:

CheckPermission(document:firstdoc, has_permission, user:caveatedreader) → HAS_PERMISSION (incorrect; should be CONDITIONAL_PERMISSION)

CheckPermission(document:firstdoc, has_permission, user:caveatedreader, context = {"somecondition": 41}) → HAS_PERMISSION (incorrect; should be NO_PERMISSION)

Patches

v1.54.0

Workarounds

Disable the dispatch result cache (ClusterDispatchCacheConfig and DispatchCacheConfig)

Database specific

{
    "cwe_ids":  [
        "CWE-863"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-06-19T21:42:12Z",
    "nvd_published_at":  null,
    "severity":  "LOW"
}

References

Affected packages

Go / github.com/authzed/spicedb

Package

Name: github.com/authzed/spicedb; View open source insights on deps.dev
Purl: pkg:golang/github.com/authzed/spicedb

Affected ranges

Type: SEMVER
Events: Introduced

1.34.0

Fixed

1.54.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-4vrg-r928-h5vv/GHSA-4vrg-r928-h5vv.json"