| id: GO-2026-5133 | |
| modules: | |
| - module: github.com/authzed/spicedb | |
| versions: | |
| - introduced: 1.34.0 | |
| - fixed: 1.54.0 | |
| vulnerable_at: 1.53.0 | |
| summary: |- | |
| SpiceDB: Checks involving relations with caveats can result in unconditional | |
| permission when conditional permission is expected in github.com/authzed/spicedb | |
| cves: | |
| - CVE-2026-55866 | |
| ghsas: | |
| - GHSA-4vrg-r928-h5vv | |
| references: | |
| - advisory: https://github.com/authzed/spicedb/security/advisories/GHSA-4vrg-r928-h5vv | |
| source: | |
| id: GHSA-4vrg-r928-h5vv | |
| created: 2026-06-25T01:44:41.378826295-04:00 | |
| review_status: UNREVIEWED |