CVE-2024-32001: SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used

April 10, 2024

Any user making a negative authorization decision based on the results of a LookupSubjects request with version before v1.30.1 is affected.

References

github.com/advisories/GHSA-j85q-46hg-36p2
github.com/authzed/spicedb
github.com/authzed/spicedb/commit/a244ed1edfaf2382711dccdb699971ec97190c7b
github.com/authzed/spicedb/security/advisories/GHSA-j85q-46hg-36p2
nvd.nist.gov/vuln/detail/CVE-2024-32001

Code Behaviors & Features

Detect and mitigate CVE-2024-32001 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →