CVE-2025-49011: Authzed Spicedb Auth Bypass Vulnerability

CVE-2025-49011 Overview

CVE-2025-49011 affects SpiceDB, an open source database for storing and querying fine-grained authorization data developed by Authzed. The flaw exists in versions prior to 1.44.2. When a schema contains arrows with caveats on the arrow'ed relation, CheckPermission requests that traverse multiple caveated branches may return a negative response when a positive result is expected. The issue is classified under CWE-358: Improperly Implemented Security Check for Standard. Authzed released a fix in version 1.44.2.

Critical Impact
Permission checks may incorrectly deny access to legitimate principals, leading to authorization integrity failures in applications relying on SpiceDB for access decisions.

Affected Products

Authzed SpiceDB versions prior to 1.44.2
Deployments using schemas with caveats defined over arrow'ed relations
Applications invoking CheckPermission on affected schema patterns

Discovery Timeline

2025-06-06 - CVE-2025-49011 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49011

Vulnerability Analysis

SpiceDB evaluates permissions by traversing a graph of relations defined in a schema. Arrow expressions walk from one relation to a computed userset on the target object. Caveats attach conditional logic to relationships, and their evaluation may return true, false, or a partial result depending on supplied context.

When an arrow'ed relation carries caveats and a CheckPermission request evaluates multiple caveated branches, the dispatcher terminates before all branches contribute their results. A branch that could resolve to a positive permission is discarded, producing a NO_PERMISSION response for a subject that should receive HAS_PERMISSION. The defect impacts authorization correctness rather than confidentiality, matching the low integrity impact reflected in the CVSS vector.

Root Cause

The dispatcher in internal/graph/check.go did not require complete evaluation of all sub-results when incoming caveats were present on the arrow'ed relation. Short-circuit evaluation returned the first conclusive branch, ignoring caveated branches whose combined outcome could invert the result.

Attack Vector

The issue is not an attacker-driven exploit in the traditional sense. Any client issuing CheckPermission requests over the network against a vulnerable schema can trigger the incorrect result. Applications relying on SpiceDB for gating operations may deny legitimate users, which can be leveraged for denial of function or masking of misconfigured policies.

// Patch excerpt from internal/graph/check.go
		toDispatch,
		func(ctx context.Context, crc currentRequestContext, dd checkDispatchChunk) CheckResult {
			resourceType := dd.resourceType
+			if dd.hasIncomingCaveats {
+				crc.resultsSetting = v1.DispatchCheckRequest_REQUIRE_ALL_RESULTS
+			}
			childResult := cc.checkComputedUserset(ctx, crc, ttu.GetComputedUserset(), &resourceType, dd.resourceIds)
			if childResult.Err != nil {
				return childResult
// Source: https://github.com/authzed/spicedb/commit/fe8dd9f491f6975b3408c401e413a530eb181a67

The fix forces REQUIRE_ALL_RESULTS dispatch mode whenever the branch carries incoming caveats, ensuring every caveated path contributes to the final decision.

Detection Methods for CVE-2025-49011

Indicators of Compromise

Unexpected NO_PERMISSION responses from CheckPermission calls involving arrow expressions and caveats
Application logs recording authorization failures for users known to hold the granting relationship
Version banners or /metrics output reporting SpiceDB releases earlier than 1.44.2

Detection Strategies

Inventory SpiceDB deployments and compare their reported versions against 1.44.2 using package manifests, container image tags, or the gRPC reflection service.
Audit schemas for the pattern of arrow expressions whose target relation is annotated with a caveat, since only these schemas are affected.
Replay representative CheckPermission requests against a patched instance and diff the results to surface incorrect denials.

Monitoring Recommendations

Alert on spikes in authorization denials or user-reported access failures following SpiceDB upgrades or schema changes.
Track SpiceDB release channel notifications and the GitHub Security Advisory GHSA-cwwm-hr97-qfxm for follow-up guidance.
Instrument the dispatch layer with metrics on caveated branch evaluations to detect regressions after future upgrades.

How to Mitigate CVE-2025-49011

Immediate Actions Required

Upgrade all SpiceDB instances to version 1.44.2 or later.
Restart dependent services after upgrade to purge cached dispatch results generated by the vulnerable code path.
Re-run authorization regression tests to confirm previously failing checks now return the expected decision.

Patch Information

Authzed released the fix in GitHub Release v1.44.2. The change is delivered via commit fe8dd9f491f6975b3408c401e413a530eb181a67 and documented in the GitHub Security Advisory GHSA-cwwm-hr97-qfxm.

Workarounds

Refactor affected schemas to remove caveats defined over an arrow'ed relation until the upgrade completes.
Move caveat evaluation to the subject side of the relationship where the arrow does not traverse a caveated edge.
Add application-level fallbacks that re-check permissions through an alternate code path when a denial is unexpected.

bash

# Verify SpiceDB version and upgrade via container image
docker run --rm authzed/spicedb:latest version
docker pull authzed/spicedb:v1.44.2
kubectl set image deployment/spicedb spicedb=authzed/spicedb:v1.44.2
kubectl rollout status deployment/spicedb