Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

spicedb — Vulnerabilities & Security Advisories 15

All 15 CVE vulnerabilities found in spicedb, with AI-generated Chinese analysis, references, and POCs.

This page aggregates vulnerabilities associated with Spicedb, a database product, categorized by specific weakness types and security tags. It collects records of reported security flaws, spanning advisories published in recent years. The database encompasses various flaw classes including memory corruption, input validation errors, and authentication bypasses. By browsing this section, you can track the vendor's published advisories, understand the prevalence of specific weakness categories, and examine the complete vulnerability history for the Spicedb product line. The collection focuses on confirmed issues documented in public security bulletins. Each entry links to detailed reports, providing context on the nature of the defect and its potential impact on system integrity. The data is organized to facilitate comparative analysis across different release cycles. Users can filter entries by tag or date to narrow down the dataset to a manageable subset for review. This resource serves as a central repository for monitoring the evolving security posture of the product.

Vendor: authzed

CVE ID Title CVSS Severity Published
CVE-2026-55866 SpiceDBChecks involving relations with caveats can result in unconditional permission when conditional permission is expected CWE-863 3.7 Low 2026-09-14
CVE-2026-46668 SpiceDB: Caveat structures with nested lists can result in improper cache reuse CWE-285 - - 2026-06-10
CVE-2026-40091 SpiceDB: SPICEDB_DATASTORE_CONN_URI is leaked on startup logs CWE-532 6.0 Medium 2026-04-14
CVE-2025-65111 SpiceDB's LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results CWE-277 5.4 - 2025-11-21
CVE-2025-64529 SpiceDB's WriteRelationships fails silently if payload is too big CWE-770 8.1 - 2025-11-10
CVE-2025-49011 SpiceDB checks involving relations with caveats can result in no permission when permission is expected CWE-358 3.7 Low 2025-06-06
CVE-2024-48909 SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not CWE-172 2.0 Low 2024-10-14
CVE-2024-46989 Multiple caveats on resources of the same type can result in no permission when permission is expected CWE-269 3.7 Low 2024-09-18
CVE-2024-38361 Permissions processing error in spacedb CWE-281 3.7 Low 2024-06-20
CVE-2024-32001 SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used CWE-755 2.2 Low 2024-04-10
CVE-2024-27101 Integer overflow in chunking helper causes dispatching to miss elements or panic CWE-190 7.3 High 2024-03-01
CVE-2023-46255 `SPICEDB_DATASTORE_CONN_URI` is leaked when URI cannot be parsed CWE-532 4.2 Medium 2023-10-31
CVE-2023-35930 LookupResources may return partial results in spicedb CWE-913 3.7 Low 2023-06-26
CVE-2023-29193 SpiceDB binding metrics port to untrusted networks and can leak command-line flags CWE-209 8.7 High 2023-04-14
CVE-2022-21646 Lookup operations do not take into account wildcards in SpiceDB CWE-155 8.1 High 2022-01-11

All 15 known CVE vulnerabilities affecting spicedb with full Chinese analysis, references, and POCs where available.