CVE-2025-49011 - CVE House
Back to Database
Status published Low CVE-2025-49011

SpiceDB checks involving relations with caveats can result in no permission when permission is expected

Vulnerability Description

SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected. Version 1.44.2 fixes the issue. As a workaround, do not use caveats in the schema over an arrow’ed relation.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-49011

Credits & Attribution

No credits recorded in the NVD database.

References

More from authzed

View All →
CVE-2025-65111
SpiceDB's LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results
Low 2.9
CVE-2025-64529
SpiceDB's WriteRelationships fails silently if payload is too big
Low 2.7
CVE-2024-48909
SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not
Low 2
CVE-2024-46989
Multiple caveats on resources of the same type can result in no permission when permission is expected
Low 3.7
CVE-2024-38361
Permissions processing error in spacedb
Low 3.7

Affected Vendor

Affected Software

spicedb
Vulnerable Versions:
< 1.44.2

Timeline

Official Publish: June 6th, 2025
Last Modified: June 6th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-358

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.