Kurz gesagt
- CVE-2024-38361 ist eine Schwachstelle (MITTEL (CVSS 5.3)) in github.com/authzed/spicedb, spicedb (authzed).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.40%, höher als bei 33.8% aller Schwachstellen.
- Abhilfe: auf 1.33.1 oder neuer aktualisieren.
Description
Background
Use of an exclusion under an arrow that has multiple resources may resolve to NO_PERMISSION when permission is expected.
For example, given this schema:
definition user {}
definition folder {
relation member: user
relation banned: user
permission view = member - banned
}
definition resource {
relation folder: folder
permission view = folder->view
}
If the resource exists under multiple folders and the user has access to view more than a single folder, SpiceDB may report the user does not have access due to a failure in the exclusion dispatcher to request that all the folders in which the user is a member be returned
Impact
Permission is returned as NO_PERMISSION when PERMISSION is expected on the CheckPermission API.
Workarounds
None
NVD description
Spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Use of an exclusion under an arrow that has multiple resources may resolve to `NO_PERMISSION` when permission is expected. If the resource exists under *multiple* folders and the user has access to view more than a single folder, SpiceDB may report the user does not have access due to a failure in the exclusion dispatcher to request that *all* the folders in which the user is a member be returned. Permission is returned as `NO_PERMISSION` when `PERMISSION` is expected on the `CheckPermission` API. This issue has been addressed in version 1.33.1. All users are advised to upgrade. There are no known workarounds for this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free