CVE-2024-32001

Summary

CVE-2024-32001 is a vulnerability affecting the SpiceDB graph database. It allows an attacker to manipulate access control data, specifically using a relation of the form `relation folder: folder | folder#parent` with an arrow such as `folder->view`, to cause LookupSubjects to only return subjects found under either `folder` or `folder#parent`. This issue arises when the same subject type is used multiple times in a relation, and relationships exist for both subject types. A user making a negative authorization decision based on the results of a LookupSubjects request before version 1.30.1 is susceptible to this bug. Version 1.30.1 includes a patch for the vulnerability, and as a workaround, users are advised to avoid using LookupSubjects for negative authorization decisions or the broken schema.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.