SpiceDB having multiple caveats on resources of the same type may improperly result in no permission
## Background Multiple caveats over the same indirect subject type on the same relation can result in no permission being returned when permission is expected For example, given this schema: ``` definition user {} caveat somecaveat(somefield int) { somefield == 42 } definition group { relation member: user } definition resource { relation viewer: group#member with somecaveat permission view = folder->view } ``` If the resource has multiple groups, and each group is caveated, it is possible for the returned permission to be "no permission" when permission is expected. ## Impact Permission is returned as NO_PERMISSION when PERMISSION is expected on the CheckPermission API. ## Workarounds Do not use caveats or do not use caveats on an indirect subject type with multiple entries
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-46989US | medium5.3 | — | ||
spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Multiple caveats over the same indirect sub… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/authzed/spicedbPACKAGE
- https://github.com/authzed/spicedb/commit/20855de75812bcbc975efebe7f76abf47c0f3edbWEB
- https://github.com/authzed/spicedb/commit/d4ef8e1dbce1eafaf25847f4c0f09738820f5bf2WEB
- https://github.com/authzed/spicedb/security/advisories/GHSA-jhg6-6qrx-38mrWEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-46989ADVISORY
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan