CVE-2025-49011

SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected. Version 1.44.2 fixes the issue. As a workaround, do not use caveats in the schema over an arrow’ed relation.

SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected. Version 1.44.2 fixes the issue. As a workaround, do not use caveats in the schema over an arrow’ed relation.

SpiceDB checks involving relations with caveats can result in no permission when permission is expected in github.com/authzed/spicedb

### Impact On schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected. For example, given this schema: ``` definition user {} definition office { relation parent: office relation manager: user permission read = manager + parent->read } definition group { relation parent: office permission read = parent->read } definition document { relation owner: group with equals permission read = owner->read } caveat equals(actual string, required string) { actual == required } ``` and these relationships: ``` office:headoffice#manager@user:maria office:branch1#parent@office:headoffice group:admins#parent@office:branch1 group:managers#parent@office:headoffice document:budget#owner@group:admins[equals:{"required":"admin"}] document:budget#owner@group:managers[equals:{"required":"manager"}] ``` Permission for `'document:budget#read@user:maria with {"actual" : "admin"}'` is returned as NO_PERMISSION when HAS_PERMISSION is the correct answer. ### Patches Upgrade to v1.44.2. ### Workarounds Do not use caveats in your schema over an arrow’ed relation.

SpiceDB es una base de datos de código abierto para almacenar y consultar datos de autorización detallados. Antes de la versión 1.44.2, en esquemas con flechas y advertencias en la relación con flechas, cuando la ruta para resolver una solicitud CheckPermission implica la evaluación de varias ramas con advertencias, las solicitudes podían devolver una respuesta negativa cuando se esperaba una positiva. La versión 1.44.2 soluciona este problema. Como solución alternativa, no utilice advertencias en el esquema sobre una relación con flechas.