{"cve":"CVE-2025-49011","nvd":{"published":"2025-06-06T18:15:35.497","modified":"2026-06-17T09:30:40.123","status":"Analyzed","description":"SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected. Version 1.44.2 fixes the issue. As a workaround, do not use caveats in the schema over an arrow’ed relation.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":5.3},"cwes":["CWE-358"],"references":["https://github.com/authzed/spicedb/commit/fe8dd9f491f6975b3408c401e413a530eb181a67","https://github.com/authzed/spicedb/releases/tag/v1.44.2","https://github.com/authzed/spicedb/security/advisories/GHSA-cwwm-hr97-qfxm"],"products":["authzed:spicedb"],"source":"nvd","synced_at":"2026-10-19T22:02:23.998251710+00:00"},"epss":{"cve":"CVE-2025-49011","score":0.00315,"percentile":0.24473,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-cwwm-hr97-qfxm","url":"https://osv.dev/vulnerability/GHSA-cwwm-hr97-qfxm","summary":"SpiceDB checks involving relations with caveats can result in no permission when permission is expected","modified":"2025-06-10T19:58:49Z","packages":[{"ecosystem":"Go","name":"github.com/authzed/spicedb","purl":"pkg:golang/github.com/authzed/spicedb","ranges":["<1.44.2"],"fixed":["1.44.2"]}]},{"id":"GO-2025-3744","url":"https://osv.dev/vulnerability/GO-2025-3744","summary":"SpiceDB checks involving relations with caveats can result in no permission when permission is expected in github.com/authzed/spicedb","modified":"2026-03-03T04:56:40.080273Z","packages":[{"ecosystem":"Go","name":"github.com/authzed/spicedb","purl":"pkg:golang/github.com/authzed/spicedb","ranges":["<1.44.2"],"fixed":["1.44.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}