{"id":"CVE-2024-46989","aliases":["GHSA-jhg6-6qrx-38mr","GO-2024-3131"],"url":"https://o3.security/vulnerability/CVE-2024-46989","summary":"Multiple caveats on resources of the same type can result in no permission when permission is expected","details":"## Background\n\nMultiple caveats over the same indirect subject type on the same relation can result in no permission being returned when permission is expected\n\nFor example, given this schema:\n\n```\ndefinition user {}\n\ncaveat somecaveat(somefield int) {\n  somefield == 42\n}\n\ndefinition group {\n  relation member: user\n}\n\ndefinition resource {\n  relation viewer: group#member with somecaveat\n  permission view = folder->view\n}\n```\n\nIf the resource has multiple groups, and each group is caveated, it is possible for the returned permission to be \"no permission\" when permission is expected.\n\n## Impact\nPermission is returned as NO_PERMISSION when PERMISSION is expected on the CheckPermission API.\n\n## Workarounds\nDo not use caveats or do not use caveats on an indirect subject type with multiple entries","published":"2024-09-18T17:29:06.456Z","modified":"2026-08-12T03:51:13.807572841Z","cvss":{"score":3.7,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/authzed/spicedb","fixedVersion":"1.35.3"}],"fix":{"url":"https://github.com/authzed/spicedb/commit/d4ef8e1dbce1eafaf25847f4c0f09738820f5bf2","label":"authzed/spicedb@d4ef8e1"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/46xxx/CVE-2024-46989.json"},{"type":"ADVISORY","url":"https://github.com/authzed/spicedb/security/advisories/GHSA-jhg6-6qrx-38mr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46989"},{"type":"FIX","url":"https://github.com/authzed/spicedb/commit/d4ef8e1dbce1eafaf25847f4c0f09738820f5bf2"},{"type":"WEB","url":"https://github.com/authzed/spicedb/commit/20855de75812bcbc975efebe7f76abf47c0f3edb"},{"type":"PACKAGE","url":"https://github.com/authzed/spicedb"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:13.807572841Z"}}