1 line
2.7 KiB
JSON
1 line
2.7 KiB
JSON
{"schema_version":"1.9.0","id":"GHSA-cwwm-hr97-qfxm","published":"2025-06-06T21:41:00Z","modified":"2025-06-10T19:58:49Z","aliases":["CVE-2025-49011","GO-2025-3744"],"summary":"SpiceDB checks involving relations with caveats can result in no permission when permission is expected","details":"### Impact\n\nOn schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected.\n\nFor example, given this schema:\n\n```\ndefinition user {}\n\ndefinition office {\n\trelation parent: office\n\trelation manager: user\n\tpermission read = manager + parent->read\n}\n\ndefinition group {\n\trelation parent: office\n\tpermission read = parent->read\n}\n\ndefinition document {\n\trelation owner: group with equals\n\tpermission read = owner->read\n}\n\ncaveat equals(actual string, required string) {\n\tactual == required\n}\n```\n\nand these relationships:\n\n```\noffice:headoffice#manager@user:maria\noffice:branch1#parent@office:headoffice\ngroup:admins#parent@office:branch1\ngroup:managers#parent@office:headoffice\ndocument:budget#owner@group:admins[equals:{\"required\":\"admin\"}]\ndocument:budget#owner@group:managers[equals:{\"required\":\"manager\"}]\n```\n\nPermission for `'document:budget#read@user:maria with {\"actual\" : \"admin\"}'` is returned as NO_PERMISSION when HAS_PERMISSION is the correct answer.\n\n### Patches\nUpgrade to v1.44.2.\n\n### Workarounds\nDo not use caveats in your schema over an arrow’ed relation.","affected":[{"package":{"name":"github.com/authzed/spicedb","ecosystem":"Go","purl":"pkg:golang/github.com/authzed/spicedb"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.44.2"}]}],"database_specific":{"last_known_affected_version_range":"<= 1.44.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-cwwm-hr97-qfxm/GHSA-cwwm-hr97-qfxm.json"}}],"references":[{"type":"WEB","url":"https://github.com/authzed/spicedb/security/advisories/GHSA-cwwm-hr97-qfxm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49011"},{"type":"WEB","url":"https://github.com/authzed/spicedb/commit/fe8dd9f491f6975b3408c401e413a530eb181a67"},{"type":"PACKAGE","url":"https://github.com/authzed/spicedb"},{"type":"WEB","url":"https://github.com/authzed/spicedb/releases/tag/v1.44.2"}],"database_specific":{"cwe_ids":["CWE-358"],"github_reviewed":true,"github_reviewed_at":"2025-06-06T21:41:00Z","nvd_published_at":"2025-06-06T18:15:35Z","severity":"LOW"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}]} |