{"id":"CVE-2025-49011","aliases":["GHSA-cwwm-hr97-qfxm","GO-2025-3744"],"url":"https://o3.security/vulnerability/CVE-2025-49011","summary":"SpiceDB checks involving relations with caveats can result in no permission when permission is expected","details":"### Impact\n\nOn schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected.\n\nFor example, given this schema:\n\n```\ndefinition user {}\n\ndefinition office {\n\trelation parent: office\n\trelation manager: user\n\tpermission read = manager + parent->read\n}\n\ndefinition group {\n\trelation parent: office\n\tpermission read = parent->read\n}\n\ndefinition document {\n\trelation owner: group with equals\n\tpermission read = owner->read\n}\n\ncaveat equals(actual string, required string) {\n\tactual == required\n}\n```\n\nand these relationships:\n\n```\noffice:headoffice#manager@user:maria\noffice:branch1#parent@office:headoffice\ngroup:admins#parent@office:branch1\ngroup:managers#parent@office:headoffice\ndocument:budget#owner@group:admins[equals:{\"required\":\"admin\"}]\ndocument:budget#owner@group:managers[equals:{\"required\":\"manager\"}]\n```\n\nPermission for `'document:budget#read@user:maria with {\"actual\" : \"admin\"}'` is returned as NO_PERMISSION when HAS_PERMISSION is the correct answer.\n\n### Patches\nUpgrade to v1.44.2.\n\n### Workarounds\nDo not use caveats in your schema over an arrow’ed relation.","published":"2025-06-06T17:36:21.747Z","modified":"2026-08-12T03:51:40.926136646Z","cvss":{"score":3.7,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"},"epss":{"score":0.00315,"percentile":0.24502,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/authzed/spicedb","fixedVersion":"1.44.2"}],"fix":{"url":"https://github.com/authzed/spicedb/commit/fe8dd9f491f6975b3408c401e413a530eb181a67","label":"authzed/spicedb@fe8dd9f"},"references":[{"type":"WEB","url":"https://github.com/authzed/spicedb/releases/tag/v1.44.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49011.json"},{"type":"ADVISORY","url":"https://github.com/authzed/spicedb/security/advisories/GHSA-cwwm-hr97-qfxm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49011"},{"type":"FIX","url":"https://github.com/authzed/spicedb/commit/fe8dd9f491f6975b3408c401e413a530eb181a67"},{"type":"PACKAGE","url":"https://github.com/authzed/spicedb"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:40.926136646Z"}}