{"id":"CVE-2026-55866","revision":null,"records":[{"revision":"6e42066510664d378c9fefaf4397336b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-55866","aliases":[],"title":"SpiceDBChecks involving relations with caveats can result in unconditional permission when conditional permission is expected","description":"SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIP_HAS_PERMISSION instead of PERMISSIONSHIP_CONDITIONAL_PERMISSION or PERMISSIONSHIP_NO_PERMISSION because checkRequestToKey() and checkRequestToKeyWithCanonical() in internal/dispatch/keys/computed.go omit CheckHints when constructing dispatch Check cache keys. The incorrect result requires a permission combining relations with intersection or exclusion, a subject reachable through caveated and non-caveated branches, LookupResources with a context parameter running concurrently with CheckPermission or CheckBulkPermissions for the same resource and subject, and an enabled dispatch result cache. Under these conditions, a result computed for one hint set can poison the cache entry used by a semantically different authorization check, allowing permission without satisfying the caveat. This issue is fixed in version 1.54.0.","state":0,"publishedAt":"2026-09-14T17:23:56.428+00:00","modifiedAt":"2026-09-14T18:15:41.075+00:00","affected":[{"ecosystem":"Vendor product","name":"spicedb","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"authzed\",\n                    \"product\": \"spicedb\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 1.34.1, < 1.54.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","score":3.7,"severity":"LOW"}],"references":["https://github.com/authzed/spicedb/security/advisories/GHSA-4vrg-r928-h5vv","https://github.com/authzed/spicedb/pull/3188","https://github.com/authzed/spicedb/commit/44a1c9f266bd8a884bfebfc27181210302541b9b","https://github.com/authzed/spicedb/commit/ccde792fc48750740d025d4286d5c2c88614cd30","https://github.com/authzed/spicedb/releases/tag/v1.54.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-55866","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-55866","identifiers":["CVE-2026-55866"]},"retained":false,"historicalAffected":[]},{"revision":"90c92338330944e0b6a1ed4298a36cf9","observedAt":"2026-11-11T14:05:03.446+00:00","statement":{"source":"euvd","id":"EUVD-2026-77689","aliases":["CVE-2026-55866","GHSA-4vrg-r928-h5vv"],"title":"SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIP_HAS_PERMISSION instead of PERMISSIONSHIP_CONDITIONAL_PERMISSION or PE…","description":"SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIP_HAS_PERMISSION instead of PERMISSIONSHIP_CONDITIONAL_PERMISSION or PERMISSIONSHIP_NO_PERMISSION because checkRequestToKey() and checkRequestToKeyWithCanonical() in internal/dispatch/keys/computed.go omit CheckHints when constructing dispatch Check cache keys. The incorrect result requires a permission combining relations with intersection or exclusion, a subject reachable through caveated and non-caveated branches, LookupResources with a context parameter running concurrently with CheckPermission or CheckBulkPermissions for the same resource and subject, and an enabled dispatch result cache. Under these conditions, a result computed for one hint set can poison the cache entry used by a semantically different authorization check, allowing permission without satisfying the caveat. This issue is fixed in version 1.54.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","score":3.7,"severity":null}],"references":["https://github.com/authzed/spicedb/security/advisories/GHSA-4vrg-r928-h5vv","https://github.com/authzed/spicedb/pull/3188","https://github.com/authzed/spicedb/commit/44a1c9f266bd8a884bfebfc27181210302541b9b","https://github.com/authzed/spicedb/commit/ccde792fc48750740d025d4286d5c2c88614cd30","https://github.com/authzed/spicedb/releases/tag/v1.54.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-77689","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 14, 2026, 5:23:56 PM","dateUpdated":"Sep 14, 2026, 6:15:41 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-77689","identifiers":["EUVD-2026-77689","CVE-2026-55866","GHSA-4vrg-r928-h5vv"]},"retained":false,"historicalAffected":[]},{"revision":"c91c4c8614fb49408d950f8225853d25","observedAt":"2026-10-25T14:19:05.298+00:00","statement":{"source":"nvd","id":"CVE-2026-55866","aliases":[],"title":"SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIP_HAS_PERMISSION instead of PERMISSIONSHIP_CONDITIONAL_PERMISSION or PE…","description":"SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIP_HAS_PERMISSION instead of PERMISSIONSHIP_CONDITIONAL_PERMISSION or PERMISSIONSHIP_NO_PERMISSION because checkRequestToKey() and checkRequestToKeyWithCanonical() in internal/dispatch/keys/computed.go omit CheckHints when constructing dispatch Check cache keys. The incorrect result requires a permission combining relations with intersection or exclusion, a subject reachable through caveated and non-caveated branches, LookupResources with a context parameter running concurrently with CheckPermission or CheckBulkPermissions for the same resource and subject, and an enabled dispatch result cache. Under these conditions, a result computed for one hint set can poison the cache entry used by a semantically different authorization check, allowing permission without satisfying the caveat. This issue is fixed in version 1.54.0.","state":0,"publishedAt":"2026-09-14T18:17:56.15+00:00","modifiedAt":"2026-09-30T19:38:27.293+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","score":3.7,"severity":"LOW"}],"references":["https://github.com/authzed/spicedb/commit/44a1c9f266bd8a884bfebfc27181210302541b9b","https://github.com/authzed/spicedb/commit/ccde792fc48750740d025d4286d5c2c88614cd30","https://github.com/authzed/spicedb/pull/3188","https://github.com/authzed/spicedb/releases/tag/v1.54.0","https://github.com/authzed/spicedb/security/advisories/GHSA-4vrg-r928-h5vv"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55866","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-863"],"productCriteria":[],"sourceDates":{"published":"2026-09-14T18:17:56.150","lastModified":"2026-09-30T19:38:27.293"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-55866","identifiers":["CVE-2026-55866"]},"retained":false,"historicalAffected":[]},{"revision":"1fd8f84cb25040a08130d829e2cb9538","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-4vrg-r928-h5vv","aliases":["CVE-2026-55866","GO-2026-5133"],"title":"SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected","description":"### Impact\n Under concurrency, `CheckPermission` and `CheckBulkPermissions` can return `PERMISSIONSHIP_HAS_PERMISSION` for a (resource, permission, subject) whose correct answer is   `PERMISSIONSHIP_CONDITIONAL_PERMISSION`. \n\n You are impacted if **all** of the following hold:\n\n  1. Your schema has a permission combining relations with an intersection or exclusion, where a subject reaches it through a caveated branch and a non-caveated branch. For example:\n\n```zed\n  definition user {}\n\n  caveat some_caveat(somecondition int) { somecondition == 42 }\n\n  definition document {\n    relation reader: user | user with some_caveat\n    relation writer: user\n    relation banned: user\n    permission has_permission = (reader & writer) - banned\n  }\n```\n\n  2. A subject reaches the permission via the caveated edge:\n\n```\n  document:firstdoc#reader@user:caveatedreader[some_caveat]\n  document:firstdoc#writer@user:caveatedreader\n```\n  3. Your workload issues `LookupResources` with a `context` request parameter, concurrently with `CheckPermission/CheckBulkPermissions` for the same subject/resource, and\n  4. The dispatch result cache is enabled.\n  \nWhen all of the above are true, there is an intermittent window in which:\n\n`CheckPermission(document:firstdoc, has_permission, user:caveatedreader)` → HAS_PERMISSION (incorrect; should be CONDITIONAL_PERMISSION)\n\n`CheckPermission(document:firstdoc, has_permission, user:caveatedreader, context = {\"somecondition\": 41})` → HAS_PERMISSION (incorrect; should be NO_PERMISSION)\n\n### Patches\n\nv1.54.0\n\n### Workarounds\nDisable the dispatch result cache (`ClusterDispatchCacheConfig` and `DispatchCacheConfig`)","state":0,"publishedAt":"2026-06-19T21:42:12+00:00","modifiedAt":"2026-06-25T18:56:25.9054063+00:00","affected":[{"ecosystem":"Go","name":"github.com/authzed/spicedb","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.34.0"},{"kind":"fixed","version":"1.54.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"LOW"}],"references":["https://github.com/authzed/spicedb/security/advisories/GHSA-4vrg-r928-h5vv","https://github.com/authzed/spicedb"],"sourceUrl":"https://github.com/advisories/GHSA-4vrg-r928-h5vv","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-4vrg-r928-h5vv","identifiers":["GHSA-4vrg-r928-h5vv","CVE-2026-55866","GO-2026-5133"]},"retained":false,"historicalAffected":[]},{"revision":"5198575ceb2149c39d34112136dcdf46","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5133","aliases":["CVE-2026-55866","GHSA-4vrg-r928-h5vv"],"title":"SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected in github.com/authzed/spicedb","description":"SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected in github.com/authzed/spicedb","state":0,"publishedAt":"2026-06-25T18:26:48+00:00","modifiedAt":"2026-06-25T18:45:25.2824816+00:00","affected":[{"ecosystem":"Go","name":"github.com/authzed/spicedb","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.34.0"},{"kind":"fixed","version":"1.54.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/authzed/spicedb/security/advisories/GHSA-4vrg-r928-h5vv"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5133","license":"OSV · upstream source license applies","key":"osv:GO-2026-5133","identifiers":["GO-2026-5133","CVE-2026-55866","GHSA-4vrg-r928-h5vv"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-12T02:56:45.8822264+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-12T02:56:45.8822264+00:00","lastSuccessAt":"2026-11-12T02:56:46.0427292+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:46.0427301+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-64752486c567b55b31fb0d7225f5222bcd0019564ac0ac5f0649e242c7b19299-c8f0a5eb97b437649f83f6fe632ec849fcb249052407d33e475e82c88b318dfb","complete":true,"records":424535,"lastAttemptAt":"2026-11-12T02:56:45.3610802+00:00","lastSuccessAt":"2026-11-12T02:56:45.341976+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:45.3610802+00:00","snapshotPublishedAt":"2026-11-12T02:25:26+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-cf3e7a73d6e04a5db0af1b2eb21b09f1","complete":false,"records":13760,"lastAttemptAt":"2026-11-12T03:06:38.440851+00:00","lastSuccessAt":"2026-11-12T03:06:38.5018927+00:00","error":null,"lastVerifiedAt":"2026-11-12T03:06:38.5018927+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-12T02:56:45.8822264+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-12T02:56:45.8822264+00:00","lastSuccessAt":"2026-11-12T02:56:46.0434469+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:46.0434471+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-729a419ccc5f41d8a3330c7c6e8b6a5e","complete":true,"records":13760,"lastAttemptAt":"2026-11-12T02:57:11.7691852+00:00","lastSuccessAt":"2026-11-12T02:57:11.766+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:57:11.766+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-12T02:56:45.7363501+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:45.7363501+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-12T02:56:45.5271491+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:45.5271491+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-baa8362b4daf9e5f39d5563775a55935e7b442c0735d33274a921579ce4a0d66","complete":true,"records":3093,"lastAttemptAt":"2026-11-12T02:56:45.8443473+00:00","lastSuccessAt":"2026-11-11T13:00:02.5446881+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:45.8443473+00:00","snapshotPublishedAt":"2026-11-11T12:47:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-685fe7fb2b690656c910a1ea42a9d294e8353311ac8ecfa691a9b0ff1b328804","complete":true,"records":231695,"lastAttemptAt":"2026-11-12T02:56:45.6384803+00:00","lastSuccessAt":"2026-11-11T21:58:47.7265713+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:45.6384803+00:00","snapshotPublishedAt":"2026-11-11T21:48:35+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}