3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-49011

CVE-2025-49011: SpiceDB checks involving relations with caveats can result in no permission when permission is expected

Impact

On schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected.

For example, given this schema:

definition user {}

definition office {
	relation parent: office
	relation manager: user
	permission read = manager + parent->read
}

definition group {
	relation parent: office
	permission read = parent->read
}

definition document {
	relation owner: group with equals
	permission read = owner->read
}

caveat equals(actual string, required string) {
	actual == required
}

and these relationships:

office:headoffice#manager@user:maria
office:branch1#parent@office:headoffice
group:admins#parent@office:branch1
group:managers#parent@office:headoffice
document:budget#owner@group:admins[equals:{"required":"admin"}]
document:budget#owner@group:managers[equals:{"required":"manager"}]

Permission for 'document:budget#read@user:maria with {"actual" : "admin"}' is returned as NO_PERMISSION when HAS_PERMISSION is the correct answer.

Patches

Upgrade to v1.44.2.

Workarounds

Do not use caveats in your schema over an arrow’ed relation.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-49011

CVE-2025-49011:

3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/authzed/spicedb	go	<= 1.44.0	1.44.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability (GHSA-cwwm-hr97-qfxm) in SpiceDB caused incorrect 'NO_PERMISSION' responses for certain permission checks that should have resulted in 'HAS_PERMISSION'. This primarily occurred in schemas where relations involved caveats, and the permission resolution path required evaluating multiple caveated branches, especially when 'arrow' relations (->) were used.

The root cause was traced to how SpiceDB's dispatch graph handled these complex caveated checks. Specifically, the checkTupleToUserset function within internal/graph/check.go (a method of ParallelChecker) did not always ensure that all possible resolution paths were explored when incoming caveats were present. It was missing logic to explicitly require all results (v1.DispatchCheckRequest_REQUIRE_ALL_RESULTS) in such scenarios. This oversight meant that the system might make a premature decision based on incomplete information, particularly if one evaluation path resolved faster but didn't grant permission, while another valid, caveated path was not fully processed.

A secondary, potentially contributing issue, was addressed in the populateFoundSubjects function in internal/developmentmembership/membership.go. If the flawed evaluation of caveated branches led to a situation where an intersection of subject sets resulted in no common subjects (an 'intersection with no children'), the function would previously error out. This error could halt the entire check or prevent other valid branches from being considered, thereby contributing to the incorrect final permission.

The patches address these issues by:

Modifying checkTupleToUserset to explicitly set crc.resultsSetting = v1.DispatchCheckRequest_REQUIRE_ALL_RESULTS when dd.hasIncomingCaveats is true, ensuring a thorough evaluation.
Modifying populateFoundSubjects to return an empty set instead of an error for empty intersections, improving the robustness of membership resolution.

These changes ensure that caveated checks are evaluated more completely and resiliently, correcting the false negative permission results. Runtime profiles during exploitation or when triggering the bug would likely show these functions being invoked under conditions where their pre-patch logic would lead to an incorrect outcome.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

3.7

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-49011: SpiceDB checks involving relations with caveats can result in no permission when permission is expected

Impact

Patches

Workarounds

CVE-2025-49011:

3.7

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

CVE-2025-49011: SpiceDB checks involving relations with caveats can result in no permission when permission is expected

Impact

Patches

Workarounds

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

3.7

3.7

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI