Incorrect Authorization Affecting github.com/authzed/spicedb/internal/dispatch/keys package, versions >=1.34.0 <1.54.0

Affected versions of this package are vulnerable to Incorrect Authorization in the permission evaluation process under concurrent requests involving both CheckPermission/CheckBulkPermissions and LookupResources with a context parameter, when the dispatch result cache is enabled. An attacker can gain unintended permissions by exploiting a race condition where a subject reaches a permission through both caveated and non-caveated branches, resulting in the system granting unconditional access when conditional access is expected. This is only exploitable if the schema combines relations with intersection or exclusion, a subject reaches the permission via a caveated edge, concurrent requests are made as described, and the dispatch result cache is enabled.

This vulnerability can be mitigated by disabling the dispatch result cache (ClusterDispatchCacheConfig and DispatchCacheConfig).

• GitHub Advisory
• GitHub Commit
• GitHub Release