PT-2024-24352 · Spicedb · Spicedb

Lowecordell · Published 2024-04-10 · Updated 2025-09-02 · CVE-2024-32001

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SpiceDB versions prior to v1.30.1

Description The issue arises from the use of a specific relation form, relation folder: folder | folder#parent, combined with an arrow, such as folder->view, which can cause LookupSubjects to return only partial results. This occurs when the same subject type is used multiple times in a relation, and relationships exist for both subject types, along with the use of an arrow over the relation. Any user relying on LookupSubjects for negative authorization decisions with versions before v1.30.1 is affected.

Recommendations For versions prior to v1.30.1, update to version v1.30.1 to resolve the issue. As a temporary workaround, consider avoiding the use of LookupSubjects for negative authorization decisions and/or avoid using the broken schema.

Exploit

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2024-32001

GHSA-J85Q-46HG-36P2

GO-2024-2716

Affected Products

Spicedb

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32001.json · Exploit
• https://github.com/authzed/spicedb/commit/a244ed1edfaf2382711dccdb699971ec97190c7b · Patch
• https://github.com/authzed/spicedb/security/advisories/GHSA-j85q-46hg-36p2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32001 · Security Note
• https://osv.dev/vulnerability/GO-2024-2716 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-32001 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j85q-46hg-36p2 · Vendor Advisory
• https://github.com/authzed/spicedb · Note
• https://github.com/authzed/spicedb/releases/tag/v1.30.1 · Note
• https://twitter.com/CVEnew/status/1778263589788467446 · Twitter Post
• https://t.me/cveNotify/134135 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1778218986158584292 · Twitter Post