CVE-2024-48909 - CVE House
Back to Database
Status published Low CVE-2024-48909

SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not

Vulnerability Description

SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior to version 1.37.1, clients that have enabled `LookupResources2` and have caveats in the evaluation path for their requests can return a permissionship of `CONDITIONAL` with context marked as missing, even then the context was supplied. LookupResources2 is the new default in SpiceDB 1.37.0 and has been opt-in since SpiceDB 1.35.0. The bug is patched as part of SpiceDB 1.37.1. As a workaround, disable LookupResources2 via the `--enable-experimental-lookup-resources` flag by setting it to `false`.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-48909

Credits & Attribution

No credits recorded in the NVD database.

References

More from authzed

View All →
CVE-2025-65111
SpiceDB's LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results
Low 2.9
CVE-2025-64529
SpiceDB's WriteRelationships fails silently if payload is too big
Low 2.7
CVE-2025-49011
SpiceDB checks involving relations with caveats can result in no permission when permission is expected
Low 3.7
CVE-2024-46989
Multiple caveats on resources of the same type can result in no permission when permission is expected
Low 3.7
CVE-2024-38361
Permissions processing error in spacedb
Low 3.7

Affected Vendor

Affected Software

spicedb
Vulnerable Versions:
>= 1.35.0, < 1.37.1

Timeline

Official Publish: October 14th, 2024
Last Modified: October 15th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-172

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.