CVE-2024-38361

Spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Use of an exclusion under an arrow that has multiple resources may resolve to `NO_PERMISSION` when permission is expected. If the resource exists under *multiple* folders and the user has access to view more than a single folder, SpiceDB may report the user does not have access due to a failure in the exclusion dispatcher to request that *all* the folders in which the user is a member be returned. Permission is returned as `NO_PERMISSION` when `PERMISSION` is expected on the `CheckPermission` API. This issue has been addressed in version 1.33.1. All users are advised to upgrade. There are no known workarounds for this issue.

• CWE-281

• https://github.com/authzed/spicedb/commit/ecef31d2b266fde17eb2c3415e2ec4ceff96fbebPatch
• https://github.com/authzed/spicedb/security/advisories/GHSA-grjv-gjgr-66g2Exploit, Vendor Advisory
• https://github.com/authzed/spicedb/commit/ecef31d2b266fde17eb2c3415e2ec4ceff96fbebPatch
• https://github.com/authzed/spicedb/security/advisories/GHSA-grjv-gjgr-66g2Exploit, Vendor Advisory

Published

Jun 20, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-38355Socket.IO is an open source, real-time, bidirectional, event…7.3
• CVE-2024-38356TinyMCE is an open source rich text editor. A cross-site scr…6.1
• CVE-2024-38357TinyMCE is an open source rich text editor. A cross-site scr…6.1
• CVE-2024-38358Wasmer is a web assembly (wasm) Runtime supporting WASIX, WA…2.9
• CVE-2024-38359The Lightning Network Daemon (lnd) - is a complete implement…6.5
• CVE-2024-38360Discourse is an open source platform for community discussio…4.9
• CVE-2024-38363Airbyte is a data integration platform for ELT pipelines. Ai…8.5
• CVE-2024-38364DSpace is an open source software is a turnkey repository ap…2.6
• CVE-2024-38365btcd is an alternative full node bitcoin implementation writ…8.1
• CVE-2024-38366trunk.cocoapods.org is the authentication server for the Coa…10
• CVE-2024-38367trunk.cocoapods.org is the authentication server for the Coa…9.6
• CVE-2024-38368trunk.cocoapods.org is the authentication server for the Coa…9.3