authzed spicedb vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20233
3. 20245
4. 20253
5. 20263

Newest CVEs

• CVE-2026-55866

  SpiceDBChecks involving relations with caveats can result in unconditional permission when conditional permission is expected

  authzed · spicedb

  Low3.7
• CVE-2026-46668

  SpiceDB: Caveat structures with nested lists can result in improper cache reuse

  authzed · spicedb

  Low2.3
• CVE-2026-40091

  SpiceDB: SPICEDB_DATASTORE_CONN_URI is leaked on startup logs

  authzed · spicedb

  Medium6.0
• CVE-2025-65111

  SpiceDB's LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results

  authzed · spicedb

  Low2.9
• CVE-2025-64529

  SpiceDB's WriteRelationships fails silently if payload is too big

  authzed · spicedb

  Low2.7
• CVE-2025-49011

  SpiceDB checks involving relations with caveats can result in no permission when permission is expected

  authzed · spicedb

  Low3.7
• CVE-2024-48909

  SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not

  authzed · spicedb

  Low2.0
• CVE-2024-46989

  Multiple caveats on resources of the same type can result in no permission when permission is expected

  authzed · spicedb

  Low3.7
• CVE-2024-38361

  Permissions processing error in spacedb

  authzed · spicedb

  Low3.7
• CVE-2024-32001

  SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used

  authzed · spicedb

  Low2.2