SpiceDB, an open source database for managing application permissions, contains an incorrect authorization vulnerability (CWE-863) in versions >=1.34.1 and <1.54.0. The functions checkRequestToKey() and checkRequestToKeyWithCanonical() omit CheckHints when building dispatch cache keys, causing the dispatch result cache to be poisoned. Under conditions involving permission combinations with intersection or exclusion, subjects reachable via caveated and non-caveated branches, concurrent LookupResources and CheckPermission calls for the same resource and subject, and an enabled dispatch cache, a cached result computed for one hint set can be reused incorrectly for a semantically different authorization check. This leads to permission being granted without satisfying the caveat. The flaw is resolved in version 1.54.0.

The vulnerability can cause incorrect authorization decisions, allowing permissions to be granted without fulfilling required caveats. This impacts the integrity of permission enforcement but does not affect confidentiality or availability. The CVSS v3.1 base score is 3.7 (low severity), reflecting a network attack vector with high attack complexity and no privileges or user interaction required. There are no known exploits in the wild.

Upgrade SpiceDB to version 1.54.0 or later, where this issue is fixed. No other mitigations are indicated. Patch status is confirmed by the vendor advisory stating the fix is in 1.54.0.