SpiceDB vulnerabilities
3 known CVE vulnerabilities in SpiceDB, translated and rated.
- CVE-2026-55866Low
SpiceDB from 1.34.0 until 1.54.0 can return PERMISSIONSHIP_HAS_PERMISSION instead of PERMISSIONSHIP_CONDITIONAL_PERMISSION or PERMISSIONSHIP_NO_PERMISSION because checkRequestToKey() and checkRequestToKeyWithCanonical() in internal/dispatch/keys/computed.go omit CheckHints when constructing dispatch Check cache keys. A result computed for one hint set can poison the cache entry used by a semantically different authorization check.
- CVE-2026-46668Low
In SpiceDB from version 1.15.0 to before 1.52.0, caveat structures with nested lists can result in improper cache reuse. This issue has been patched in version 1.52.0.
- CVE-2023-35930Low
SpiceDB, a Google Zanzibar-inspired database system, has an issue with negative authorization decisions using the `LookupResources` request in version 1.22.0. Users may incorrectly gain access to resources that should be blocked.