Skip to main content

Spicedb CVE-2025-49011

| EUVDEUVD-2025-17360 LOW
Improperly Implemented Security Check for Standard (CWE-358)
2025-06-06 security-advisories@github.com GHSA-cwwm-hr97-qfxm
Information Disclosure Spicedb Authzed
3.7
CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY
3.7 LOW
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

4
EUVD ID Assigned
Mar 14, 2026 - 18:10 euvd
EUVD-2025-17360
Analysis Generated
Mar 14, 2026 - 18:10 vuln.today
Patch released
Mar 14, 2026 - 18:10 nvd
Patch available
CVE Published
Jun 06, 2025 - 18:15 nvd
LOW 3.7

DescriptionGitHub Advisory

SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected. Version 1.44.2 fixes the issue. As a workaround, do not use caveats in the schema over an arrow’ed relation.

AnalysisAI

A remote code execution vulnerability in SpiceDB (CVSS 3.7). Remediation should follow standard vulnerability management procedures. Vendor patch is available.

Technical ContextAI

Vulnerability type: remote code execution. Affects SpiceDB.

RemediationAI

Apply the vendor-supplied patch immediately.

More in Spicedb

View all
CVE-2024-38361 MEDIUM POC
5.3 Jun 20

Spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for custom
CVE-2024-27101 CRITICAL
9.1 Mar 01

SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application per
CVE-2023-29193 HIGH
7.5 Apr 14

SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical applica
CVE-2023-46255 MEDIUM
6.5 Oct 31

SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application per
CVE-2024-46989 MEDIUM
5.3 Sep 18

spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for custom
CVE-2023-35930 MEDIUM
5.3 Jun 26

SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical applica
CVE-2024-32001 MEDIUM
4.3 Apr 10

SpiceDB is a graph database purpose-built for storing and evaluating access control data. Rated medium severity (CVSS 4.
CVE-2024-48909 LOW
2.4 Oct 14

SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Rated low severity
CVE-2025-65111 LOW
2.9 Nov 21

SpiceDB is an open source database system for creating and managing security-critical application permissions. Rated low
CVE-2025-64529 LOW
2.7 Nov 10

SpiceDB is an open source database system for creating and managing security-critical application permissions. Rated low

Same weakness CWE-358 – Improperly Implemented Security Check for Standard

View all
CVE-2019-14823 HIGH POC
7.4
CVE-2024-5500 MEDIUM POC
6.5
CVE-2018-0268 CRITICAL
10.0
CVE-2016-10229 CRITICAL
9.8
CVE-2025-66603 CRITICAL
9.8
CVE-2023-3266 CRITICAL
9.8
CVE-2019-6742 CRITICAL
9.8
CVE-2026-48797 CRITICAL
9.3

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2025-49011 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy