CVE-2025-49011: Github.com/authzed/spicedb SpiceDB Checks Involving Relations With Vulnerability
LOWCVE-2025-49011 is a LOW (CVSS 3.7) spicedb checks involving relations with vulnerability (CWE-358: Improperly Implemented Security Check for Standard) affecting Github.com/authzed/spicedb libraries in the Go ecosystem. The issue involves spicedb checks involving relations with caveats can result in no permission when permission is expected. Remediation is available by upgrading affected packages to version 1.44.2.
CVE-2025-49011 at a Glance
Security Impact
CVSS: 3.7
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
How to Fix CVE-2025-49011
To remediate this vulnerability, upgrade all affected Github.com/authzed/spicedb dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/authzed/spicedb to 1.44.2Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/authzed/spicedbHow to Check if You Are Affected
To determine whether your application is affected by CVE-2025-49011, inspect your project dependencies for Github.com/authzed/spicedb:
inspect dependencies for github.com/authzed/spicedbAnalyze the terminal output to locate any version of Github.com/authzed/spicedb in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.44.2), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-358: Improperly Implemented Security Check for Standard, where the product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique. In Github.com/authzed/spicedb, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2025-49011 Affected Github.com/authzed/spicedb Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/authzed/spicedb
|
Go |
< 1.44.2
|
1.44.2
|
References
Frequently Asked Questions
What is CVE-2025-49011?
Which Github.com/authzed/spicedb versions are affected?
What version fixes CVE-2025-49011?
Is github.com/authzed/spicedb affected?
What is the CVSS score of CVE-2025-49011?
What CWE is associated with CVE-2025-49011?
How can I check Go dependencies for CVE-2025-49011?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-cwwm-hr97-qfxm",
"modified" : "2025-06-10T19:58:49Z",
"published" : "2025-06-06T21:41:00Z",
"aliases" : [ "CVE-2025-49011" ],
"summary" : "SpiceDB checks involving relations with caveats can result in no permission when permission is expected",
"details" : "### Impact\n\nOn schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected.\n\nFor example, given this schema:\n\n```\ndefinition user {}\n\ndefinition office {\n\trelation parent: office\n\trelation manager: user\n\tpermission read = manager + parent->read\n}\n\ndefinition group {\n\trelation parent: office\n\tpermission read = parent->read\n}\n\ndefinition document {\n\trelation owner: group with equals\n\tpermission read = owner->read\n}\n\ncaveat equals(actual string, required string) {\n\tactual == required\n}\n```\n\nand these relationships:\n\n```\noffice:headoffice#manager@user:maria\noffice:branch1#parent@office:headoffice\ngroup:admins#parent@office:branch1\ngroup:managers#parent@office:headoffice\ndocument:budget#owner@group:admins[equals:{\"required\":\"admin\"}]\ndocument:budget#owner@group:managers[equals:{\"required\":\"manager\"}]\n```\n\nPermission for `'document:budget#read@user:maria with {\"actual\" : \"admin\"}'` is returned as NO_PERMISSION when HAS_PERMISSION is the correct answer.\n\n### Patches\nUpgrade to v1.44.2.\n\n### Workarounds\nDo not use caveats in your schema over an arrow’ed relation.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/authzed/spicedb"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.44.2"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 1.44.0"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/authzed/spicedb/security/advisories/GHSA-cwwm-hr97-qfxm"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-49011"
}, {
"type" : "WEB",
"url" : "https://github.com/authzed/spicedb/commit/fe8dd9f491f6975b3408c401e413a530eb181a67"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/authzed/spicedb"
}, {
"type" : "WEB",
"url" : "https://github.com/authzed/spicedb/releases/tag/v1.44.2"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-358" ],
"severity" : "LOW",
"github_reviewed" : true,
"github_reviewed_at" : "2025-06-06T21:41:00Z",
"nvd_published_at" : "2025-06-06T18:15:35Z"
}
}