Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-49011

SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected. Version 1.44.2 fixes the issue. As a workaround, do not use caveats in the schema over an arrow’ed relation.

Published

2025-06-06T18:15:35.497

Last Modified

2025-09-04T16:48:00.090

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 3.7 (LOW)

Weaknesses
  • Type: Secondary
    CWE-358
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application authzed spicedb < 1.44.2 Yes
References