CVE-2024-38361

CVE-2024-38361 is a medium-severity vulnerability affecting Authzed SpiceDB, an open-source permissions database. It can lead to incorrect authorization decisions where a user, despite having legitimate access to a resource through multiple paths, is denied permission due to a flaw in how the system handles exclusions. This results in a "NO_PERMISSION" response when "PERMISSION" is expected. The vulnerability has a CVSS score of 5.3 (Medium), indicating a network-based attack with low complexity and no user interaction required. The primary impact is a loss of integrity, as legitimate access is incorrectly denied. There is currently no evidence of active exploitation, nor are there any public exploit codes available (Metasploit, Nuclei, ExploitDB). Community discussion and media coverage are minimal, suggesting low public awareness. Users are advised to upgrade to SpiceDB version 1.33.1 or later, as no workarounds exist.