# CVE-2026-55866: Authzed SpiceDB incorrect authorization in caveated relations

Source: https://junglewise.ai/threats/cve-2026-55866-authzed-spicedb-incorrect-authorization-in-caveated-relations  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-06-19  
License: CC BY 4.0 with a link back

CVE-2026-55866 · Severity: low · CVSS 3.7 · Published 2026-09-14

SpiceDB is a database used to manage and check fine-grained user permissions across applications. A vulnerability exists where the system may incorrectly grant full access to a resource when it should have only granted conditional access or denied it entirely. This occurs under specific high-concurrency conditions when using complex permission rules, potentially allowing users to bypass intended restrictions.

Technologies: [Authzed SpiceDB](https://junglewise.ai/threats/technologies/spicedb), [github.com/authzed/spicedb (Go)](https://junglewise.ai/threats/technologies/github-com-authzed-spicedb). Vendors: [Authzed](https://junglewise.ai/threats/vendors/authzed), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-55866 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55866 being exploited in the wild.

**How severe is CVE-2026-55866?** Low severity, with a CVSS score of 3.7, published 14 September 2026.

**Which products and versions are affected?** Authzed SpiceDB >= 1.34.0, < 1.54.0; github.com/authzed/spicedb (Go) >= 1.34.0, < 1.54.0, SEMVER:introduced=1.34.0,fixed=1.54.0.

**Is there a fix for CVE-2026-55866?** Yes. github.com/authzed/spicedb (Go): upgrade to 1.54.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55866 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-55866?** Check whether you run Authzed SpiceDB or github.com/authzed/spicedb (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/authzed/spicedb (Go): upgrade to 1.54.0 or later

  ```sh
  go get github.com/authzed/spicedb@v1.54.0
  ```


## Technical details

A race condition in SpiceDB's dispatch result cache can lead to incorrect authorization outcomes (CWE-863). When a schema uses intersections or exclusions involving both caveated and non-caveated branches, concurrent calls to CheckPermission and LookupResources can cause the cache to return a 'HAS_PERMISSION' result instead of 'CONDITIONAL_PERMISSION' or 'NO_PERMISSION'. This occurs because the cache may intermittently serve a result that ignores the required context or caveat conditions. The issue is present when the dispatch result cache is enabled and specific schema patterns are met. A fix is available in version 1.54.0, and a workaround involves disabling the dispatch result cache.

## Affected products

- Authzed SpiceDB >= 1.34.0, < 1.54.0

## Identifiers

- CVE-2026-55866
- GHSA-4vrg-r928-h5vv
- GO-2026-5133

## Timeline

- 2026-06-19: disclosed
- 2026-06-19: advisory
- 1.54.0: patched

## References

- [https://api.github.com/users/miparnisari](https://api.github.com/users/miparnisari)
- [https://github.com/miparnisari](https://github.com/miparnisari)
- [https://api.github.com/users/miparnisari/gists%7B/gist_id%7D](https://api.github.com/users/miparnisari/gists%7B/gist_id%7D)
- [https://api.github.com/users/miparnisari/repos](https://api.github.com/users/miparnisari/repos)
- [https://avatars.githubusercontent.com/u/5374887?v=4](https://avatars.githubusercontent.com/u/5374887?v=4)
- [https://api.github.com/users/miparnisari/events%7B/privacy%7D](https://api.github.com/users/miparnisari/events%7B/privacy%7D)

## Related threats

- [Authzed SpiceDB improper authorization via cache collision in caveats](https://junglewise.ai/threats/cve-2026-46668-authzed-spicedb-improper-authorization-via-cache-collision-in)
- [SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.](https://junglewise.ai/threats/cve-2026-40091-authzed-spicedb-sensitive-information-leak-in-startup-logs)
- [GO-2026-4465 - LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic in…](https://junglewise.ai/threats/go-2026-4465-lookupresources-cursor-section-tampering-can-crash-spicedb-183b4312)
- [LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic](https://junglewise.ai/threats/lookupresources-cursor-section-tampering-can-crash-spicedb-process-via-4334d59b)
- [Authzed SpiceDB incomplete LookupResources results in complex schemas](https://junglewise.ai/threats/cve-2025-65111-authzed-spicedb-incomplete-lookupresources-results-in-complex)