CVE-2026-55866

SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIP_HAS_PERMISSION instead of PERMISSIONSHIP_CONDITIONAL_PERMISSION or PERMISSIONSHIP_NO_PERMISSION because checkRequestToKey() and checkRequestToKeyWithCanonical() in internal/dispatch/keys/computed.go omit CheckHints when constructing dispatch Check cache keys. The incorrect result requires a permission combining relations with intersection or exclusion, a subject reachable through caveated and non-caveated branches, LookupResources with a context parameter running concurrently with CheckPermission or CheckBulkPermissions for the same resource and subject, and an enabled dispatch result cache. Under these conditions, a result computed for one hint set can poison the cache entry used by a semantically different authorization check, allowing permission without satisfying the caveat. This issue is fixed in version 1.54.0.

• CWE-863

• https://github.com/authzed/spicedb/commit/44a1c9f266bd8a884bfebfc27181210302541b9b
• https://github.com/authzed/spicedb/commit/ccde792fc48750740d025d4286d5c2c88614cd30
• https://github.com/authzed/spicedb/pull/3188
• https://github.com/authzed/spicedb/releases/tag/v1.54.0
• https://github.com/authzed/spicedb/security/advisories/GHSA-4vrg-r928-h5vv

Published

Sep 14, 2026

Last Modified

Sep 14, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55859MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL …5.9
• CVE-2026-5586A vulnerability was determined in zhongyu09 openchatbi up to…6.3
• CVE-2026-55860MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL …5.9
• CVE-2026-55863motionEye (mEye) is an online interface for a piece of softw…5.3
• CVE-2026-55864GeoNetwork is a catalog application to manage spatially refe…7.8
• CVE-2026-55865Python Liquid is a Python engine for the Liquid template lan…7.1
• CVE-2026-55867Graylog is a free and open log management platform. From 6.2…5.3
• CVE-2026-5587A vulnerability was identified in wbbeyourself MAC-SQL up to…6.3
• CVE-2026-55870GoCD is a continuous deliver server. Prior to 26.1.0, GoCD c…2.3
• CVE-2026-55873SeaweedFS is a distributed storage system. In versions 4.08 …4.3
• CVE-2026-55874SeaweedFS is a distributed storage system. Prior to 4.34, th…7.7
• CVE-2026-55877Symfony UX is a JavaScript ecosystem for Symfony. From 2.17.…6.1