CVE-2026-55866: SpiceDB Unconditional Permission Issue Due to Concurrency in Permission Checks
Summary
CVE-2026-55866: Impact Under concurrency, CheckPermission and CheckBulkPermissions can return PERMISSIONSHIP_HAS_PERMISSION for a (resource, permission, subject) whose correct answer is PERMISSIONSHIP_CONDITIONAL_PERMISSION. Affects github.com/authzed/spicedb versions >= 1.34.0, < 1.54.0. Fixed in 1.54.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SpiceDB is an open-source database designed for managing permissions and access control in applications. It allows developers to define complex permission schemas and evaluate permissions based on various conditions. However, it is susceptible to a concurrency issue that can lead to incorrect permission evaluations under specific circumstances.
Vulnerability Detail
The vulnerability arises when the CheckPermission and CheckBulkPermissions functions return an incorrect permission status due to concurrency. Specifically, if a permission schema combines relations with caveats and non-caveated branches, a subject may receive unconditional permission when conditional permission is expected. This can occur when a subject accesses a resource through both a caveated and a non-caveated path, especially when LookupResources is called concurrently with permission checks. The result is that the system may incorrectly grant permissions, leading to potential unauthorized access.
How To Fix
Latest published version: v1.57.0 as of 23 Oct 2026
go get github.com/authzed/spicedb@v1.57.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.54.0
This is the first release that contains the fix.
go get github.com/authzed/spicedb@v1.54.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the dispatch result cache by modifying your configuration settings. Specifically, set 'ClusterDispatchCacheConfig' and 'DispatchCacheConfig' to false to prevent the caching mechanism from affecting permission checks.
Conclusion
In summary, CVE-2026-55866 affects SpiceDB by allowing incorrect permission evaluations under concurrent access conditions. It is crucial to update to version 1.54.0 or later to mitigate this risk. Additionally, disabling the dispatch result cache can serve as a temporary workaround while a full update is performed.
See every vulnerability recorded for github.com/authzed/spicedb →
FAQ
The vulnerability allows for incorrect permission evaluations under concurrent conditions, potentially granting unauthorized access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could lead to unauthorized access to resources, compromising the security of your application.
Yes, the vulnerability is fixed in version 1.54.0 of SpiceDB. Updating to this version will resolve the issue.
The CVSS score for this vulnerability is 3.7, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/authzed/spicedb.
