CVE-2024-48909

Description

SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior to version 1.37.1, clients that have enabled `LookupResources2` and have caveats in the evaluation path for their requests can return a permissionship of `CONDITIONAL` with context marked as missing, even then the context was supplied. LookupResources2 is the new default in SpiceDB 1.37.0 and has been opt-in since SpiceDB 1.35.0. The bug is patched as part of SpiceDB 1.37.1. As a workaround, disable LookupResources2 via the `--enable-experimental-lookup-resources` flag by setting it to `false`.

CVSS v3.1 Score

2.0

LOW

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

Weakness Type (CWE)

CWE-172 CWE-172

Affected Products

Vendor	Product	Versions
authzed	spicedb	1.35.0 — 1.37.1

References

Advisories & Patches

https://github.com/authzed/spicedb/commit/2f3cf77a7fcfcb478ef5a480a245842c96ac8853

Other References

https://github.com/authzed/spicedb/security/advisories/GHSA-3c32-4hq9-6wgj

Frequently Asked Questions

What is CVE-2024-48909? +

SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior to version 1.37.1, clients that have enabled `LookupResources2` and have caveats in the evaluation path for their requests can return a permissionship of `CONDITIONAL` with context marked as missing, even then the context was supplied. LookupResources2 is the new default in SpiceDB 1.37.0 and has been opt-in since SpiceDB 1.35.0. The bug is patched as part of SpiceDB 1.37.1. As a workaround, disable LookupResources2 via the `--enable-experimental-lookup-resources` flag by setting it to `false`. It has a CVSS v3.1 base score of 2.0 (LOW).

How severe is CVE-2024-48909? +

CVE-2024-48909 has a CVSS v3.1 score of 2.0 out of 10, rated LOW. This is a low-severity vulnerability with limited impact.

What products are affected by CVE-2024-48909? +

CVE-2024-48909 affects products from authzed, specifically: spicedb. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-48909? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-12758 7.5

Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements …

CVE-2025-27110 7.5

Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking …

CVE-2026-42926 5.8

When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an …

CVE-2024-27101 7.3

SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Integer overflow in chunking helper …

CVE-2025-64529 6.5

SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions prior to 1.45.2, users …

CVE-2025-65111 5.3

SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to version 1.47.1, if a …