GHSA-3c32-4hq9-6wgj
SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/authzed/spicedb | >= 1.35.0, < 1.37.1 | 1.37.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Clients that have enabled `LookupResources2` and have caveats in the evaluation path for their requests can return a permissionship of `CONDITIONAL` with context marked as missing, even then the context was supplied.
LookupResources2 is the new default in SpiceDB 1.37.0 and has been opt-in since SpiceDB 1.35.0
### Patches
The bug will be released as part of SpiceDB 1.37.1
### Workarounds
Disable LookupResources2 via the `--enable-experimental-lookup-resources` flag by setting it to `false`
```
--enable-experimental-lookup-resources=false
```
References
External links from the advisory. They lead to third-party sites.