CVE-2026-55866

Name of the Vulnerable Software and Affected Versions SpiceDB versions prior to 1.54.0

Description Under concurrency, the CheckPermission() and CheckBulkPermissions() functions can incorrectly return PERMISSIONSHIP HAS PERMISSION instead of PERMISSIONSHIP CONDITIONAL PERMISSION for a specific resource, permission, and subject. This occurs when a schema defines a permission using intersection or exclusion where a subject accesses it through both a caveated branch and a non-caveated branch. The issue manifests when a subject reaches the permission via a caveated edge, the dispatch result cache is enabled, and LookupResources is called with a context request parameter concurrently with permission checks for the same subject and resource.

Recommendations Update to version 1.54.0. Disable the dispatch result cache by configuring ClusterDispatchCacheConfig and DispatchCacheConfig.