SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected. Version 1.44.2 fixes the issue. As a workaround, do not use caveats in the schema over an arrow’ed relation.

Affected: Go: github.com/authzed/spicedb

### Impact

On schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected.

For example, given this schema:

``` definition user {}

definition office { relation parent: office relation manager: user permission read = manager + parent->read }

definition group { relation parent: office permission read = parent->read }

definition document { relation owner: group with equals permission read = owner->read }

caveat equals(actual string, required string) { actual == required } ```

and these relationships:

``` office:headoffice#manager@user:maria office:branch1#parent@office:headoffice group:admins#parent@office:branch1 group:managers#parent@office:headoffice document:budget#owner@group:admins[equals:{"required":"admin"}] document:budget#owner@group:managers[equals:{"required":"manager"}] ```

Permission for `'document:budget#read@user:maria with {"actual" : "admin"}'` is returned as NO_PERMISSION when HAS_PERMISSION is the correct answer.

### Patches Upgrade to v1.44.2.

### Workarounds Do not use caveats in your schema over an arrow’ed relation.

govulncheck-vulndb-0.0.20250612T141001-1.1 on GA media