-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/authzed/spicedb | go | < 1.33.1 | 1.33.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from how exclusion operations were dispatched in the difference function. The original code passed the current request context (crc) directly to the handler, which might have used a results setting that allowed early termination (e.g., ALLOW_SINGLE_RESULT). The fix explicitly sets resultsSetting to REQUIRE_ALL_RESULTS for the first branch, ensuring all potential permission paths are evaluated. This matches the described failure scenario where not all folders were checked when processing exclusions, and aligns with the CWE-281 classification of improper permission preservation. The test cases added in check_test.go specifically validate this scenario, confirming the function's role in the vulnerability.
Ongoing coverage of React2Shell