AIKIDO-2025-10764
spatie/laravel-permission is vulnerable to Race Condition
30
Low Risk
This Affects:
spatie/laravel-permissionTL;DR
Affected versions of this package are vulnerable to a race condition in the loadPermissions() method of the PermissionRegistrar class. The vulnerability occurs due to a Time-of-Check to Time-of-Use (TOCTOU) flaw, where multiple concurrent requests can simultaneously pass the if ($this->permissions) check before permissions are loaded. This can result in cache stampedes, redundant database queries, performance degradation, excessive memory usage, and database overload in concurrent environments such as Laravel Octane, Swoole, or RoadRunner.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
spatie/laravel-permission is vulnerable to Race Condition in versions 0.0.1 - 6.21.0.
How to fix this
Upgrade the spatie/laravel-permission library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant