Skip to main content

Improper Preservation of Permissions

CVE-2024-38361

Medium
5.3/10

Summary

Spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Use of an exclusion under an arrow that has multiple resources may resolve to 'NO_PERMISSION' when permission is expected. If the resource exists under multiple folders and the user has access to view more than a single folder, SpiceDB may report the user does not have access due to a failure in the exclusion dispatcher to request that all the folders in which the user is a member be returned. Permission is returned as 'NO_PERMISSION' when 'PERMISSION' is expected on the 'CheckPermission' API. This issue affects the package github.com/authzed/spicedb versions prior to 1.33.1.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • NONE

CWE-281 - Improper Preservation of Permissions

The software does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

References

Advisory Timeline

  • Published