A flaw in SpiceDB versions between 1.15.0 and before 1.52.0 allows caveat structures that contain nested lists to trigger incorrect cache reuse. As a result, permission checks can return an authorization verdict that does not accurately reflect the defined rules, potentially granting unintended access to protected resources or actions.

The affected product is SpiceDB from the Authzed vendor. Versions starting with 1.15.0 up through the latest release that precedes 1.52.0 are susceptible. The patch was applied in release 1.52.0.

The CVSS score of 2.3 indicates a low severity, and the EPSS score of < 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA's KEV catalog. The attack vector is not explicitly stated in the advisory, but the flaw involves the handling of caveat data, so it is likely exploitable in contexts where an attacker can influence or craft caveat structures—either directly via the API or indirectly through data injection. An attacker who can craft such caveats could potentially bypass authorization checks and access resources they are not entitled to.