From 04a4d484cf6ce988ae2958334576cbda39c30faf Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 6 Jun 2025 21:42:24 +0000
Subject: [PATCH] Publish GHSA-cwwm-hr97-qfxm

---
 .../GHSA-cwwm-hr97-qfxm.json                  | 72 +++++++++++++++++++
 1 file changed, 72 insertions(+)
 create mode 100644 advisories/github-reviewed/2025/06/GHSA-cwwm-hr97-qfxm/GHSA-cwwm-hr97-qfxm.json

diff --git a/advisories/github-reviewed/2025/06/GHSA-cwwm-hr97-qfxm/GHSA-cwwm-hr97-qfxm.json b/advisories/github-reviewed/2025/06/GHSA-cwwm-hr97-qfxm/GHSA-cwwm-hr97-qfxm.json
new file mode 100644
index 00000000000..c5a821e708d
--- /dev/null
+++ b/advisories/github-reviewed/2025/06/GHSA-cwwm-hr97-qfxm/GHSA-cwwm-hr97-qfxm.json
@@ -0,0 +1,72 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-cwwm-hr97-qfxm",
+  "modified": "2025-06-06T21:41:00Z",
+  "published": "2025-06-06T21:41:00Z",
+  "aliases": [
+    "CVE-2025-49011"
+  ],
+  "summary": "SpiceDB checks involving relations with caveats can result in no permission when permission is expected",
+  "details": "### Impact\n\nOn schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected.\n\nFor example, given this schema:\n\n```\ndefinition user {}\n\ndefinition office {\n\trelation parent: office\n\trelation manager: user\n\tpermission read = manager + parent->read\n}\n\ndefinition group {\n\trelation parent: office\n\tpermission read = parent->read\n}\n\ndefinition document {\n\trelation owner: group with equals\n\tpermission read = owner->read\n}\n\ncaveat equals(actual string, required string) {\n\tactual == required\n}\n```\n\nand these relationships:\n\n```\noffice:headoffice#manager@user:maria\noffice:branch1#parent@office:headoffice\ngroup:admins#parent@office:branch1\ngroup:managers#parent@office:headoffice\ndocument:budget#owner@group:admins[equals:{\"required\":\"admin\"}]\ndocument:budget#owner@group:managers[equals:{\"required\":\"manager\"}]\n```\n\nPermission for `'document:budget#read@user:maria with {\"actual\" : \"admin\"}'` is returned as NO_PERMISSION when HAS_PERMISSION is the correct answer.\n\n### Patches\nUpgrade to v1.44.2.\n\n### Workarounds\nDo not use caveats in your schema over an arrow’ed relation.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/authzed/spicedb"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.44.2"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 1.44.0"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/authzed/spicedb/security/advisories/GHSA-cwwm-hr97-qfxm"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49011"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/authzed/spicedb/commit/fe8dd9f491f6975b3408c401e413a530eb181a67"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/authzed/spicedb"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/authzed/spicedb/releases/tag/v1.44.2"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-358"
+    ],
+    "severity": "LOW",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-06-06T21:41:00Z",
+    "nvd_published_at": "2025-06-06T18:15:35Z"
+  }
+}
\ No newline at end of file