GHSA-grjv-gjgr-66g2

Source

https://github.com/advisories/GHSA-grjv-gjgr-66g2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-grjv-gjgr-66g2/GHSA-grjv-gjgr-66g2.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-grjv-gjgr-66g2

Aliases

Related

CGA-pfrr-qxjv-xmf4

Published

2024-06-20T16:24:01Z

Modified

2024-11-18T16:26:46Z

Severity

3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

SpiceDB exclusions can result in no permission returned when permission expected

Details

Background

Use of an exclusion under an arrow that has multiple resources may resolve to NO_PERMISSION when permission is expected.

For example, given this schema:

definition user {}

definition folder {
  relation member: user
  relation banned: user
  permission view = member - banned
}

definition resource {
  relation folder: folder
  permission view = folder->view
}

If the resource exists under multiple folders and the user has access to view more than a single folder, SpiceDB may report the user does not have access due to a failure in the exclusion dispatcher to request that all the folders in which the user is a member be returned

Impact

Permission is returned as NO_PERMISSION when PERMISSION is expected on the CheckPermission API.

Workarounds

None

Database specific

{
    "nvd_published_at": "2024-06-20T23:15:52Z",
    "github_reviewed_at": "2024-06-20T16:24:01Z",
    "cwe_ids": [
        "CWE-281"
    ],
    "severity": "MODERATE",
    "github_reviewed": true
}

References

Affected packages

Go / github.com/authzed/spicedb

Package

Name: github.com/authzed/spicedb; View open source insights on deps.dev
Purl: pkg:golang/github.com/authzed/spicedb

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.33.1