CVE-2024-32001
CVSS 3.1 Score 2.2 of 10 (low)
Details
Summary
CVE-2024-32001 is a vulnerability affecting the SpiceDB graph database. It allows an attacker to manipulate access control data, specifically using a relation of the form `relation folder: folder | folder#parent` with an arrow such as `folder->view`, to cause LookupSubjects to only return subjects found under either `folder` or `folder#parent`. This issue arises when the same subject type is used multiple times in a relation, and relationships exist for both subject types. A user making a negative authorization decision based on the results of a LookupSubjects request before version 1.30.1 is susceptible to this bug. Version 1.30.1 includes a patch for the vulnerability, and as a workaround, users are advised to avoid using LookupSubjects for negative authorization decisions or the broken schema.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions