CVE-2024-46989
SpiceDB having multiple caveats on resources of the same type may improperly result in no permission
Impact
## Background Multiple caveats over the same indirect subject type on the same relation can result in no permission being returned when permission is expected For example, given this schema: ``` definition user {} caveat somecaveat(somefield int) { somefield == 42 } definition group { relation member: user } definition resource { relation viewer: group#member with somecaveat permission view = folder->view } ``` If the resource has multiple groups, and each group is caveated, it is possible for the returned permission to be "no permission" when permission is expected. ## Impact Permission is returned as NO_PERMISSION when PERMISSION is expected on the CheckPermission API. ## Workarounds Do not use caveats or do not use caveats on an indirect subject type with multiple entries
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/authzed/spicedb | < 1.35.3 | 1.35.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Authzed | Spicedb | before 1.35.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/authzed/spicedb/commit/d4ef8e1dbce1eafaf25847f4c0f09738820f5bf2
- https://github.com/authzed/spicedb/security/advisories/GHSA-jhg6-6qrx-38mr
- https://github.com/advisories/GHSA-jhg6-6qrx-38mr
- https://github.com/authzed/spicedb/commit/20855de75812bcbc975efebe7f76abf47c0f3edb
- https://nvd.nist.gov/vuln/detail/CVE-2024-46989