How severe is CVE-2024-46989?

CVE-2024-46989 has a CVSS 3.x base score of 3.7, rated low severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.

Is CVE-2024-46989 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (21st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-46989?

CVE-2024-46989 affects Authzed Spicedb. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-46989?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-46989 have an EU (EUVD) identifier?

Yes. CVE-2024-46989 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-2822.

When was CVE-2024-46989 published?

CVE-2024-46989 was published on 2024-09-18 and last updated on 2026-06-17.

CVE-2024-46989

CVE-2024-46989 is a low-severity vulnerability in Authzed Spicedb with a CVSS 3.x base score of 3.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-269.

Key facts

Severity: Low (CVSS 3.x base score 3.7)
EPSS exploit prediction: 0% (21st percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-2822
Weakness: CWE-269
Affected product: Authzed Spicedb
Published: 2024-09-18
Last modified: 2026-06-17

Description

spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Multiple caveats over the same indirect subject type on the same relation can result in no permission being returned when permission is expected. If the resource has multiple groups, and each group is caveated, it is possible for the returned permission to be "no permission" when permission is expected. Permission is returned as NO_PERMISSION when PERMISSION is expected on the CheckPermission API. This issue has been addressed in release version 1.35.3. Users are advised to upgrade. Users unable to upgrade should not use caveats or avoid the use of caveats on an indirect subject type with multiple entries.

Frequently asked questions

What is CVE-2024-46989?: spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Multiple caveats over the same indirect subject type on the same relation can result in no permission being returned when permission is expected. If the resource has multiple groups, and each group is caveated, it is possible for the returned permission to be "no permission" when permission is expected. Permission is returned as NO_PERMISSION when PERMISSION is expected on the CheckPermission API. This issue has been addressed in release version 1.35.3. Users are advised to upgrade. Users unable to upgrade should not use caveats or avoid the use of caveats on an indirect subject type with multiple entries.
How severe is CVE-2024-46989?: CVE-2024-46989 has a CVSS 3.x base score of 3.7, rated low severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2024-46989 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (21st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-46989?: CVE-2024-46989 affects Authzed Spicedb. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-46989?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-46989 have an EU (EUVD) identifier?: Yes. CVE-2024-46989 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-2822.
When was CVE-2024-46989 published?: CVE-2024-46989 was published on 2024-09-18 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:authzed:spicedb:*:*:*:*:*:*:*:*

More vulnerabilities in Authzed Spicedb

CVE-2023-29193 — High (CVSS 8.7): SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical…
CVE-2022-21646 — High (CVSS 8.1): SpiceDB is a database system for managing security-critical application permissions. Any user making use of a wildcard…
CVE-2024-27101 — High (CVSS 7.3): SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application…
CVE-2025-64529 — Medium (CVSS 6.5): SpiceDB is an open source database system for creating and managing security-critical application permissions. In…
CVE-2026-40091 — Medium (CVSS 6.0): SpiceDB is an open source database system for creating and managing security-critical application permissions. In…
CVE-2025-65111 — Medium (CVSS 5.3): SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to…

All CVEs affecting Authzed Spicedb →

Other CWE-269 (Improper Privilege Management) vulnerabilities

CVE-2026-31852 — Critical (CVSS 10.0): Jellyfin is an open-source media system. The code-quality.yml GitHub Actions workflow in jellyfin/jellyfin-ios is…
CVE-2025-20282 — Critical (CVSS 10.0): A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to…
CVE-2025-0505 — Critical (CVSS 10.0): On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain…
CVE-2023-48418 — Critical (CVSS 10.0): In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a possible way to access adb before SUW…
CVE-2023-48419 — Critical (CVSS 10.0): An attacker in the wifi vicinity of a target Google Home can spy on the victim, resulting in Elevation of Privilege
CVE-2023-31273 — Critical (CVSS 10.0): Protection mechanism failure in some Intel DCM software before version 5.2 may allow an unauthenticated user to…

Browse all CWE-269 (Improper Privilege Management) vulnerabilities →