CVE-2024-48909: spicedb — Fix

Description

SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior to version 1.37.1, clients that have enabled `LookupResources2` and have caveats in the evaluation path for their requests can return a permissionship of `CONDITIONAL` with context marked as missing, even then the context was supplied. LookupResources2 is the new default in SpiceDB 1.37.0 and has been opt-in since SpiceDB 1.35.0. The bug is patched as part of SpiceDB 1.37.1. As a workaround, disable LookupResources2 via the `--enable-experimental-lookup-resources` flag by setting it to `false`.

Is your site exposed to CVE-2024-48909?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

2.0

LOW

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

Weakness Type (CWE)

CWE-172 CWE-172

Affected Products

Vendor	Product	Versions
authzed	spicedb	1.35.0 — 1.37.1

References

Advisories & Patches

https://github.com/authzed/spicedb/commit/2f3cf77a7fcfcb478ef5a480a245842c96ac8853

Other References

https://github.com/authzed/spicedb/security/advisories/GHSA-3c32-4hq9-6wgj

Frequently Asked Questions

What is CVE-2024-48909? +

SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior to version 1.37.1, clients that have enabled `LookupResources2` and have caveats in the evaluation path for their requests can return a permissionship of `CONDITIONAL` with context marked as missing, even then the context was supplied. LookupResources2 is the new default in SpiceDB 1.37.0 and has been opt-in since SpiceDB 1.35.0. The bug is patched as part of SpiceDB 1.37.1. As a workaround, disable LookupResources2 via the `--enable-experimental-lookup-resources` flag by setting it to `false`. It has a CVSS v3.1 base score of 2.0 (LOW).

How severe is CVE-2024-48909? +

CVE-2024-48909 has a CVSS v3.1 score of 2.0 out of 10, rated LOW. This is a low-severity vulnerability with limited impact.

What products are affected by CVE-2024-48909? +

CVE-2024-48909 affects products from authzed, specifically: spicedb. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-48909? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-27110 7.5

Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking …

CVE-2026-106122 7.5

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to …

CVE-2025-12758 7.5

Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements …

CVE-2026-100891 7.3

A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is the function …

CVE-2026-48784 6.1

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, …

CVE-2026-110306 6.1

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, …

CVE-2024-48909