CVE-2026-55866: SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, Spi

Executive brief

SpiceDB is a database used to manage and check fine-grained user permissions across applications. A vulnerability exists where the system may incorrectly grant full access to a resource when it should have only granted conditional access or denied it entirely. This occurs under specific high-concurrency conditions when using complex permission rules, potentially allowing users to bypass intended restrictions.

Technical details

A race condition in SpiceDB's dispatch result cache can lead to incorrect authorization outcomes (CWE-863). When a schema uses intersections or exclusions involving both caveated and non-caveated branches, concurrent calls to CheckPermission and LookupResources can cause the cache to return a 'HAS_PERMISSION' result instead of 'CONDITIONAL_PERMISSION' or 'NO_PERMISSION'. This occurs because the cache may intermittently serve a result that ignores the required context or caveat conditions. The issue is present when the dispatch result cache is enabled and specific schema patterns are met. A fix is available in version 1.54.0, and a workaround involves disabling the dispatch result cache.

Affected products

• Authzed SpiceDB >= 1.34.0, < 1.54.0

Timeline

• 2026-06-19: disclosed
• 2026-06-19: advisory
• 1.54.0: patched

References

• https://api.github.com/users/miparnisari
• https://github.com/miparnisari
• https://api.github.com/users/miparnisari/gists%7B/gist_id%7D
• https://api.github.com/users/miparnisari/repos
• https://avatars.githubusercontent.com/u/5374887?v=4
• https://api.github.com/users/miparnisari/events%7B/privacy%7D