CVE-2024-48909: SpiceDB LookupResources2 Context Misreporting Vulnerability
Summary
CVE-2024-48909: Impact Clients that have enabled LookupResources2 and have caveats in the evaluation path for their requests can return a permissionship of CONDITIONAL with context marked as missing, even then the context was supplied. Affects github.com/authzed/spicedb versions >= 1.35.0, < 1.37.1. Fixed in 1.37.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SpiceDB is an open-source database designed for managing permissions and roles in applications. It provides a flexible and scalable way to enforce access control policies. The package has gained popularity for its ability to handle complex permission scenarios efficiently. However, with the introduction of the LookupResources2 feature in version 1.37.0, a vulnerability has emerged that affects how context is reported during resource lookups when caveats are applied.
Vulnerability Detail
The vulnerability arises from the implementation of the LookupResources2 function in SpiceDB, which may incorrectly report that the context is missing when it has actually been provided by the client. This issue can lead to a permissionship status of 'CONDITIONAL', causing confusion and potential security risks as users may believe they have permissions that are not accurately reflected. The problem is particularly relevant for clients utilizing caveats in their requests, as it undermines the reliability of the permission checks.
How To Fix
Latest published version: v1.57.0 as of 23 Oct 2026
go get github.com/authzed/spicedb@v1.57.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.37.1
This is the first release that contains the fix.
go get github.com/authzed/spicedb@v1.37.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the LookupResources2 feature by setting the following flag to false: '--enable-experimental-lookup-resources=false'. This can be done in the command line when starting the SpiceDB server.
Conclusion
The SpiceDB LookupResources2 vulnerability (CVE-2024-48909) presents a significant risk by misreporting context during permission checks. Users are encouraged to update to the patched version 1.37.1 to mitigate this issue. For those unable to update immediately, disabling the LookupResources2 feature serves as a temporary workaround. Utilizing tools like Vulert can further enhance your security posture by monitoring for vulnerabilities.
See every vulnerability recorded for github.com/authzed/spicedb →
FAQ
The vulnerability can lead to incorrect permissions being reported, which may allow unauthorized access or deny legitimate access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability affects SpiceDB versions from 1.35.0 to 1.37.0. The fixed version is 1.37.1.
Yes, updating to SpiceDB version 1.37.1 or later resolves the issue.
Vulert monitors open-source vulnerabilities in your software using just the Gopkg.lock file. It provides real-time alerts for vulnerabilities, helping you maintain secure applications.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/authzed/spicedb.
