Spicedb
CVE-2024-32001
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
SpiceDB is a graph database purpose-built for storing and evaluating access control data. Use of a relation of the form: relation folder: folder | folder#parent with an arrow such as folder->view can cause LookupSubjects to only return the subjects found under subjects for either folder or folder#parent. This bug only manifests if the same subject type is used multiple types in a relation, relationships exist for both subject types and an arrow is used over the relation. Any user making a negative authorization decision based on the results of a LookupSubjects request with version before v1.30.1 is affected. Version 1.30.1 contains a patch for the issue. As a workaround, avoid using LookupSubjects for negative authorization decisions and/or avoid using the broken schema.
AnalysisAI
SpiceDB is a graph database purpose-built for storing and evaluating access control data. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Technical ContextAI
This vulnerability is classified under CWE-755. SpiceDB is a graph database purpose-built for storing and evaluating access control data. Use of a relation of the form: relation folder: folder | folder#parent with an arrow such as folder->view can cause LookupSubjects to only return the subjects found under subjects for either folder or folder#parent. This bug only manifests if the same subject type is used multiple types in a relation, relationships exist for both subject types and an arrow is used over the relation. Any user making a negative authorization decision based on the results of a LookupSubjects request with version before v1.30.1 is affected. Version 1.30.1 contains a patch for the issue. As a workaround, avoid using LookupSubjects for negative authorization decisions and/or avoid using the broken schema. Affected products include: Authzed Spicedb. Version information: Version 1.30.1.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for custom
SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application per
SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical applica
SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application per
spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for custom
SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical applica
A remote code execution vulnerability in SpiceDB (CVSS 3.7). Remediation should follow standard vulnerability management
SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Rated low severity
SpiceDB is an open source database system for creating and managing security-critical application permissions. Rated low
SpiceDB is an open source database system for creating and managing security-critical application permissions. Rated low
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today