Authzed Spicedb vulnerabilities

CVE-2024-27101 [CRITICAL] CWE-190 CVE-2024-27101: SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-crit SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Integer overflow in chunking helper causes dispatching to miss elements or panic. Any SpiceDB cluster with any schema where a resource being checked has more than 65535 relationships for the same resource and subject ty

CVE-2022-21646 [HIGH] CWE-20 CVE-2022-21646: SpiceDB is a database system for managing security-critical application permissions. Any user making SpiceDB is a database system for managing security-critical application permissions. Any user making use of a wildcard relationship under the right hand branch of an `exclusion` or within an `intersection` operation will see `Lookup`/`LookupResources` return a resource as "accessible" if it is *not* accessible by virtue of the inclusion of the wildcard

CVE-2023-29193 [HIGH] CWE-209 CVE-2023-29193: SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing secur SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. The `spicedb serve` command contains a flag named `--grpc-preshared-key` which is used to protect the gRPC API from being accessed by unauthorized requests. The values of this flag are to be considered sensitive, se

CVE-2025-64529 [MEDIUM] CWE-770 CVE-2025-64529: SpiceDB is an open source database system for creating and managing security-critical application pe SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions prior to 1.45.2, users who use the exclusion operator somewhere in their authorization schema; have configured their SpiceDB server such that `--write-relationships-max-updates-per-call` is bigger than 6500; and issue calls to W

CVE-2023-46255 [MEDIUM] CWE-532 CVE-2023-46255: SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-crit SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Prior to version 1.27.0-rc1, when the provided datastore URI is malformed (e.g. by having a password which contains `:`) the full URI (including the provided password) is printed, so that the password is shown in the logs

CVE-2023-35930 [MEDIUM] CWE-913 CVE-2023-35930: SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing secur SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. Any user making a negative authorization decision based on the results of a `LookupResources` request with 1.22.0 is affected. For example, using `LookupResources` to find a list of resources to allow access to be

CVE-2024-38361 [MEDIUM] CWE-281 CVE-2024-38361: Spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained auth Spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Use of an exclusion under an arrow that has multiple resources may resolve to `NO_PERMISSION` when permission is expected. If the resource exists under *multiple* folders and the user has access to view more than a

CVE-2025-49011 [MEDIUM] CWE-358 CVE-2025-49011: SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior t SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive resp

CVE-2025-65111 [MEDIUM] CWE-277 CVE-2025-65111: SpiceDB is an open source database system for creating and managing security-critical application pe SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to version 1.47.1, if a schema includes the following characteristics: permission defined in terms of a union (+) and that union references the same relation on both sides (but one side arrows to a different permission). Then SpiceDB

CVE-2024-46989 [MEDIUM] CWE-269 CVE-2024-46989: spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained auth spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Multiple caveats over the same indirect subject type on the same relation can result in no permission being returned when permission is expected. If the resource has multiple groups, and each group is caveated, it

CVE-2024-32001 [MEDIUM] CWE-755 CVE-2024-32001: SpiceDB is a graph database purpose-built for storing and evaluating access control data. Use of a r SpiceDB is a graph database purpose-built for storing and evaluating access control data. Use of a relation of the form: `relation folder: folder | folder#parent` with an arrow such as `folder->view` can cause LookupSubjects to only return the subjects found under subjects for either `folder` or `folder#parent`. This bug only manifests if the same s

CVE-2026-40091 [MEDIUM] CWE-532 CVE-2026-40091: SpiceDB is an open source database system for creating and managing security-critical application pe SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.51.0, when SpiceDB starts with log level info, the startup "configuration" log will include the full datastore DSN, including the plaintext password, inside DatastoreConfig.URI. This issue has been fixed in vers

CVE-2026-46668 [LOW] CWE-285 CVE-2026-46668: SpiceDB is an open source database system for creating and managing security-critical application pe SpiceDB is an open source database system for creating and managing security-critical application permissions. From version 1.15.0 to before version 1.52.0, caveat structures with nested lists can result in improper cache reuse. This issue has been patched in version 1.52.0.

CVE-2024-48909 [LOW] CWE-172 CVE-2024-48909: SpiceDB is an open source database for scalably storing and querying fine-grained authorization data SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior to version 1.37.1, clients that have enabled `LookupResources2` and have caveats in the evaluation path for their requests can return a permissionship of `CONDITIONAL` with context marked as missing, even then the c