Skip to content

SpiceDB exclusions can result in no permission returned when permission expected

Low severity GitHub Reviewed Published Jun 20, 2024 in authzed/spicedb • Updated Aug 9, 2024

Package

gomod github.com/authzed/spicedb (Go)

Affected versions

< 1.33.1

Patched versions

1.33.1

Description

Background

Use of an exclusion under an arrow that has multiple resources may resolve to NO_PERMISSION when permission is expected.

For example, given this schema:

definition user {}

definition folder {
  relation member: user
  relation banned: user
  permission view = member - banned
}

definition resource {
  relation folder: folder
  permission view = folder->view
}

If the resource exists under multiple folders and the user has access to view more than a single folder, SpiceDB may report the user does not have access due to a failure in the exclusion dispatcher to request that all the folders in which the user is a member be returned

Impact

Permission is returned as NO_PERMISSION when PERMISSION is expected on the CheckPermission API.

Workarounds

None

References

@josephschorr josephschorr published to authzed/spicedb Jun 20, 2024
Published to the GitHub Advisory Database Jun 20, 2024
Reviewed Jun 20, 2024
Published by the National Vulnerability Database Jun 20, 2024
Last updated Aug 9, 2024

Severity

Low

EPSS score

0.043%
(10th percentile)

Weaknesses

CVE ID

CVE-2024-38361

GHSA ID

GHSA-grjv-gjgr-66g2

Source code

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.