{"cve":"CVE-2026-55866","nvd":{"published":"2026-09-14T18:17:56.150","modified":"2026-09-30T19:38:27.293","status":"Awaiting Analysis","description":"SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIP_HAS_PERMISSION instead of PERMISSIONSHIP_CONDITIONAL_PERMISSION or PERMISSIONSHIP_NO_PERMISSION because checkRequestToKey() and checkRequestToKeyWithCanonical() in internal/dispatch/keys/computed.go omit CheckHints when constructing dispatch Check cache keys. The incorrect result requires a permission combining relations with intersection or exclusion, a subject reachable through caveated and non-caveated branches, LookupResources with a context parameter running concurrently with CheckPermission or CheckBulkPermissions for the same resource and subject, and an enabled dispatch result cache. Under these conditions, a result computed for one hint set can poison the cache entry used by a semantically different authorization check, allowing permission without satisfying the caveat. This issue is fixed in version 1.54.0.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","score":3.7},"cwes":["CWE-863"],"references":["https://github.com/authzed/spicedb/commit/44a1c9f266bd8a884bfebfc27181210302541b9b","https://github.com/authzed/spicedb/commit/ccde792fc48750740d025d4286d5c2c88614cd30","https://github.com/authzed/spicedb/pull/3188","https://github.com/authzed/spicedb/releases/tag/v1.54.0","https://github.com/authzed/spicedb/security/advisories/GHSA-4vrg-r928-h5vv"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:53:43.293028046+00:00"},"epss":{"cve":"CVE-2026-55866","score":0.00341,"percentile":0.2737,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-4vrg-r928-h5vv","url":"https://osv.dev/vulnerability/GHSA-4vrg-r928-h5vv","summary":"SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected","modified":"2026-06-25T18:56:25.905406286Z","packages":[{"ecosystem":"Go","name":"github.com/authzed/spicedb","purl":"pkg:golang/github.com/authzed/spicedb","ranges":[">=1.34.0 <1.54.0"],"fixed":["1.54.0"]}]},{"id":"GO-2026-5133","url":"https://osv.dev/vulnerability/GO-2026-5133","summary":"SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected in github.com/authzed/spicedb","modified":"2026-06-25T18:45:25.282481592Z","packages":[{"ecosystem":"Go","name":"github.com/authzed/spicedb","purl":"pkg:golang/github.com/authzed/spicedb","ranges":[">=1.34.0 <1.54.0"],"fixed":["1.54.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}