CVE-2024-46989: SpiceDB Improper Permission Handling Due to Multiple Caveats
Summary
CVE-2024-46989: SpiceDB having multiple caveats on resources of the same type may improperly result in no permission. Affects github.com/authzed/spicedb versions < 1.35.3. Fixed in 1.35.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SpiceDB is an open-source database designed for managing permissions and access control in applications. It allows developers to define complex relationships between users, groups, and resources, enabling fine-grained access control. However, it is susceptible to a vulnerability where multiple caveats on the same indirect subject type can lead to unexpected permission denials.
Vulnerability Detail
The vulnerability arises when multiple caveats are applied to the same indirect subject type on a relation within SpiceDB. This can result in the CheckPermission API returning 'NO_PERMISSION' when access is expected. For instance, if a resource has several groups with caveated relations, the system may incorrectly evaluate permissions, leading to unauthorized access issues. This flaw can significantly impact applications relying on SpiceDB for access control, as it undermines the expected behavior of permission checks.
How To Fix
Latest published version: v1.57.0 as of 23 Oct 2026
go get github.com/authzed/spicedb@v1.57.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.35.3
This is the first release that contains the fix.
go get github.com/authzed/spicedb@v1.35.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using caveats on indirect subject types with multiple entries. Instead, consider restructuring your permissions to eliminate the need for multiple caveats on the same relation. This can be done by consolidating caveats or simplifying the permission structure.
Conclusion
In summary, CVE-2024-46989 is a vulnerability in SpiceDB that can lead to improper permission handling due to multiple caveats on the same indirect subject type. Upgrading to version 1.35.3 or later is essential to mitigate this issue. For those unable to upgrade immediately, avoiding the use of multiple caveats is recommended as a temporary workaround.
See every vulnerability recorded for github.com/authzed/spicedb →
FAQ
SpiceDB is an open-source database that provides a way to manage permissions and access control for applications, allowing for complex relationships between users, groups, and resources.
CVE-2024-46989 refers to a vulnerability in SpiceDB where multiple caveats on the same indirect subject type can lead to incorrect permission evaluations, resulting in 'NO_PERMISSION' being returned when access is expected.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 3.7, indicating a low severity level.
If an immediate upgrade is not possible, consider implementing the suggested workaround by avoiding the use of multiple caveats on indirect subject types.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/authzed/spicedb.
