SpiceDBChecks involving relations with caveats can result in unconditional permission when conditional permission is expected

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-55866 · Microsoft / collected KEV context

EUVD-2026-77689

GHSA-4vrg-r928-h5vv

GO-2026-5133

cve-program · CVE-2026-55866

• https://github.com/authzed/spicedb/security/advisories/GHSA-4vrg-r928-h5vv
• https://github.com/authzed/spicedb/pull/3188
• https://github.com/authzed/spicedb/commit/44a1c9f266bd8a884bfebfc27181210302541b9b
• https://github.com/authzed/spicedb/commit/ccde792fc48750740d025d4286d5c2c88614cd30
• https://github.com/authzed/spicedb/releases/tag/v1.54.0

euvd · EUVD-2026-77689

• https://github.com/authzed/spicedb/security/advisories/GHSA-4vrg-r928-h5vv
• https://github.com/authzed/spicedb/pull/3188
• https://github.com/authzed/spicedb/commit/44a1c9f266bd8a884bfebfc27181210302541b9b
• https://github.com/authzed/spicedb/commit/ccde792fc48750740d025d4286d5c2c88614cd30
• https://github.com/authzed/spicedb/releases/tag/v1.54.0

nvd · CVE-2026-55866

• https://github.com/authzed/spicedb/commit/44a1c9f266bd8a884bfebfc27181210302541b9b
• https://github.com/authzed/spicedb/commit/ccde792fc48750740d025d4286d5c2c88614cd30
• https://github.com/authzed/spicedb/pull/3188
• https://github.com/authzed/spicedb/releases/tag/v1.54.0
• https://github.com/authzed/spicedb/security/advisories/GHSA-4vrg-r928-h5vv

osv · GHSA-4vrg-r928-h5vv

• https://github.com/authzed/spicedb/security/advisories/GHSA-4vrg-r928-h5vv
• https://github.com/authzed/spicedb

osv · GO-2026-5133

• https://github.com/authzed/spicedb/security/advisories/GHSA-4vrg-r928-h5vv

No related operational record is retained in the current change model.