{"id":"CVE-2025-49011","aliases":["EUVD-2025-17360","GHSA-cwwm-hr97-qfxm","GO-2025-3744","openSUSE-SU-2025:15225-1"],"status":"published","title":"SpiceDB checks involving relations with caveats can result in no permission when permission is expected","description":"SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected. Version 1.44.2 fixes the issue. As a workaround, do not use caveats in the schema over an arrow’ed relation.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00329,"percentile":0.26336,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-358"],"published":"2025-06-06T17:36:21Z","modified":"2026-10-28T02:30:59Z","fixes":[{"ecosystem":"Go","package":"github.com/authzed/spicedb","fixed_in":["1.44.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/authzed/spicedb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.44.0"},{"fixed":"1.44.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/authzed/spicedb","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.44.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/authzed/spicedb","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.44.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250612T141001-1.1"}]}],"bundled":29}],"products":[{"vendor":"authzed","product":"spicedb"}],"references":[{"url":"https://github.com/authzed/spicedb/security/advisories/GHSA-cwwm-hr97-qfxm","tags":["x_refsource_CONFIRM","Patch","Third Party Advisory","advisory","web"]},{"url":"https://github.com/authzed/spicedb/commit/fe8dd9f491f6975b3408c401e413a530eb181a67","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/authzed/spicedb/releases/tag/v1.44.2","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49011","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cwwm-hr97-qfxm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49011.json","tags":["advisory"]},{"url":"https://github.com/authzed/spicedb","tags":["package"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-36846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-42818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49140","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-49011","title":"SpiceDB checks involving relations with caveats can result in no permission when permission is expected","description":"SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected. Version 1.44.2 fixes the issue. As a workaround, do not use caveats in the schema over an arrow’ed relation.","status":"published","published":"2025-06-06T17:36:21.747Z","modified":"2025-06-06T21:33:23.317Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-358"],"updated_at":"2026-11-02T14:32:25.186422Z"}],"euvd":[{"id":"EUVD-2025-17360","description":"SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected. Version 1.44.2 fixes the issue. As a workaround, do not use caveats in the schema over an arrow’ed relation.","status":"published","published":"2025-06-06T17:36:21Z","modified":"2025-06-06T21:33:23Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T20:32:28.158705Z"}],"ghsa":[{"id":"GHSA-cwwm-hr97-qfxm","title":"SpiceDB checks involving relations with caveats can result in no permission when permission is expected","description":"### Impact\n\nOn schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected.\n\nFor example, given this schema:\n\n```\ndefinition user {}\n\ndefinition office {\n\trelation parent: office\n\trelation manager: user\n\tpermission read = manager + parent-\u003eread\n}\n\ndefinition group {\n\trelation parent: office\n\tpermission read = parent-\u003eread\n}\n\ndefinition document {\n\trelation owner: group with equals\n\tpermission read = owner-\u003eread\n}\n\ncaveat equals(actual string, required string) {\n\tactual == required\n}\n```\n\nand these relationships:\n\n```\noffice:headoffice#manager@user:maria\noffice:branch1#parent@office:headoffice\ngroup:admins#parent@office:branch1\ngroup:managers#parent@office:headoffice\ndocument:budget#owner@group:admins[equals:{\"required\":\"admin\"}]\ndocument:budget#owner@group:managers[equals:{\"required\":\"manager\"}]\n```\n\nPermission for `'document:budget#read@user:maria with {\"actual\" : \"admin\"}'` is returned as NO_PERMISSION when HAS_PERMISSION is the correct answer.\n\n### Patches\nUpgrade to v1.44.2.\n\n### Workarounds\nDo not use caveats in your schema over an arrow’ed relation.","status":"published","published":"2025-06-06T21:41:00Z","modified":"2025-06-06T21:41:01Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-358"],"updated_at":"2026-11-02T14:38:46.901955Z"}],"nvd":[{"id":"CVE-2025-49011","description":"SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected. Version 1.44.2 fixes the issue. As a workaround, do not use caveats in the schema over an arrow’ed relation.","status":"published","published":"2025-06-06T18:15:35.497Z","modified":"2026-06-17T09:30:40.123Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-358"],"updated_at":"2026-11-02T14:11:11.4244Z"}],"osv":[{"id":"CVE-2025-49011","title":"SpiceDB checks involving relations with caveats can result in no permission when permission is expected","description":"SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected. Version 1.44.2 fixes the issue. As a workaround, do not use caveats in the schema over an arrow’ed relation.","status":"published","published":"2025-06-06T17:36:21.747Z","modified":"2026-10-28T02:30:59.414199652Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-358"],"updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"GHSA-cwwm-hr97-qfxm","title":"SpiceDB checks involving relations with caveats can result in no permission when permission is expected","description":"### Impact\n\nOn schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected.\n\nFor example, given this schema:\n\n```\ndefinition user {}\n\ndefinition office {\n\trelation parent: office\n\trelation manager: user\n\tpermission read = manager + parent-\u003eread\n}\n\ndefinition group {\n\trelation parent: office\n\tpermission read = parent-\u003eread\n}\n\ndefinition document {\n\trelation owner: group with equals\n\tpermission read = owner-\u003eread\n}\n\ncaveat equals(actual string, required string) {\n\tactual == required\n}\n```\n\nand these relationships:\n\n```\noffice:headoffice#manager@user:maria\noffice:branch1#parent@office:headoffice\ngroup:admins#parent@office:branch1\ngroup:managers#parent@office:headoffice\ndocument:budget#owner@group:admins[equals:{\"required\":\"admin\"}]\ndocument:budget#owner@group:managers[equals:{\"required\":\"manager\"}]\n```\n\nPermission for `'document:budget#read@user:maria with {\"actual\" : \"admin\"}'` is returned as NO_PERMISSION when HAS_PERMISSION is the correct answer.\n\n### Patches\nUpgrade to v1.44.2.\n\n### Workarounds\nDo not use caveats in your schema over an arrow’ed relation.","status":"published","published":"2025-06-06T21:41:00Z","modified":"2025-06-10T19:58:49Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-358"],"updated_at":"2026-11-02T15:46:45.639885Z"},{"id":"GO-2025-3744","title":"SpiceDB checks involving relations with caveats can result in no permission when permission is expected in github.com/authzed/spicedb","description":"SpiceDB checks involving relations with caveats can result in no permission when permission is expected in github.com/authzed/spicedb","status":"published","published":"2025-06-10T17:17:52Z","modified":"2026-03-03T04:56:40.080273Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2025:15225-1","title":"govulncheck-vulndb-0.0.20250612T141001-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250612T141001-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:30.823164Z","updated_at":"2026-11-02T16:58:37.399567Z"}]}}