CVE-2024-48909

SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior to version 1.37.1, clients that have enabled `LookupResources2` and have caveats in the evaluation path for their requests can return a permissionship of `CONDITIONAL` with context marked as missing, even then the context was supplied. LookupResources2 is the new default in SpiceDB 1.37.0 and has been opt-in since SpiceDB 1.35.0. The bug is patched as part of SpiceDB 1.37.1. As a workaround, disable LookupResources2 via the `--enable-experimental-lookup-resources` flag by setting it to `false`.

• CWE-172

• https://github.com/authzed/spicedb/commit/2f3cf77a7fcfcb478ef5a480a245842c96ac8853Patch
• https://github.com/authzed/spicedb/security/advisories/GHSA-3c32-4hq9-6wgjThird Party Advisory

Published

Oct 14, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-48903An improper access control vulnerability in Trend Micro Deep…7.8
• CVE-2024-48904An command injection vulnerability in Trend Micro Cloud Edge…9.8
• CVE-2024-48905Sematell ReplyOne 7.4.3.0 has Insecure Permissions for the /…9.1
• CVE-2024-48906Sematell ReplyOne 7.4.3.0 allows XSS via a ReplyDesk e-mail …6.1
• CVE-2024-48907Sematell ReplyOne 7.4.3.0 allows SSRF via the application se…7.5
• CVE-2024-48908lychee link checking action checks links in Markdown, HTML, …6.9
• CVE-2024-4891The Essential Blocks – Page Builder Gutenberg Blocks, Patter…5.4
• CVE-2024-48910DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanit…9.8
• CVE-2024-48911OpenCanary, a multi-protocol network honeypot, directly exec…7.8
• CVE-2024-48912GLPI is a free asset and IT management software package. Sta…8.1
• CVE-2024-48913Hono, a web framework, prior to version 4.6.5 is vulnerable …5.9
• CVE-2024-48914Vendure is an open-source headless commerce platform. Prior …9.1