Vulnerability-Lookup

CVE-2026-46668 (GCVE-0-2026-46668)

Vulnerability from cvelistv5 – Published: 2026-06-10 20:11 – Updated: 2026-06-11 16:15

Title

SpiceDB: Caveat structures with nested lists can result in improper cache reuse

Summary

SpiceDB is an open source database system for creating and managing security-critical application permissions. From version 1.15.0 to before version 1.52.0, caveat structures with nested lists can result in improper cache reuse. This issue has been patched in version 1.52.0.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-285 - Improper Authorization

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/authzed/spicedb/security/advis…	x_refsource_CONFIRM
https://github.com/authzed/spicedb/pull/3065	x_refsource_MISC
https://github.com/authzed/spicedb/releases/tag/v1.52.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
authzed	spicedb	Affected: >= 1.15.0, < 1.52.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-46668",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-11T12:29:29.612397Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T16:15:36.256Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "spicedb",
          "vendor": "authzed",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.15.0, \u003c 1.52.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SpiceDB is an open source database system for creating and managing security-critical application permissions. From version 1.15.0 to before version 1.52.0, caveat structures with nested lists can result in improper cache reuse. This issue has been patched in version 1.52.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-10T20:11:44.193Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/authzed/spicedb/security/advisories/GHSA-mqcf-gqvg-rmhm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/authzed/spicedb/security/advisories/GHSA-mqcf-gqvg-rmhm"
        },
        {
          "name": "https://github.com/authzed/spicedb/pull/3065",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/authzed/spicedb/pull/3065"
        },
        {
          "name": "https://github.com/authzed/spicedb/releases/tag/v1.52.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/authzed/spicedb/releases/tag/v1.52.0"
        }
      ],
      "source": {
        "advisory": "GHSA-mqcf-gqvg-rmhm",
        "discovery": "UNKNOWN"
      },
      "title": "SpiceDB: Caveat structures with nested lists can result in improper cache reuse"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-46668",
    "datePublished": "2026-06-10T20:11:44.193Z",
    "dateReserved": "2026-05-15T21:46:51.546Z",
    "dateUpdated": "2026-06-11T16:15:36.256Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46668",
      "date": "2026-06-24",
      "epss": "0.00276",
      "percentile": "0.19233"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46668\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-06-10T22:16:59.893\",\"lastModified\":\"2026-06-11T15:35:45.203\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"SpiceDB is an open source database system for creating and managing security-critical application permissions. From version 1.15.0 to before version 1.52.0, caveat structures with nested lists can result in improper cache reuse. This issue has been patched in version 1.52.0.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":2.3,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-285\"}]}],\"references\":[{\"url\":\"https://github.com/authzed/spicedb/pull/3065\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/authzed/spicedb/releases/tag/v1.52.0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/authzed/spicedb/security/advisories/GHSA-mqcf-gqvg-rmhm\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-46668\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-11T12:29:29.612397Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-11T12:29:34.302Z\"}}], \"cna\": {\"title\": \"SpiceDB: Caveat structures with nested lists can result in improper cache reuse\", \"source\": {\"advisory\": \"GHSA-mqcf-gqvg-rmhm\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 2.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"authzed\", \"product\": \"spicedb\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 1.15.0, \u003c 1.52.0\"}]}], \"references\": [{\"url\": \"https://github.com/authzed/spicedb/security/advisories/GHSA-mqcf-gqvg-rmhm\", \"name\": \"https://github.com/authzed/spicedb/security/advisories/GHSA-mqcf-gqvg-rmhm\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/authzed/spicedb/pull/3065\", \"name\": \"https://github.com/authzed/spicedb/pull/3065\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/authzed/spicedb/releases/tag/v1.52.0\", \"name\": \"https://github.com/authzed/spicedb/releases/tag/v1.52.0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"SpiceDB is an open source database system for creating and managing security-critical application permissions. From version 1.15.0 to before version 1.52.0, caveat structures with nested lists can result in improper cache reuse. This issue has been patched in version 1.52.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-285\", \"description\": \"CWE-285: Improper Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-06-10T20:11:44.193Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-46668\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-11T16:15:36.256Z\", \"dateReserved\": \"2026-05-15T21:46:51.546Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-06-10T20:11:44.193Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-46668

Vulnerability from fkie_nvd - Published: 2026-06-10 22:16 - Updated: 2026-06-17 10:53

Severity

2.3 (Low) - CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/authzed/spicedb/pull/3065
	security-advisories@github.com	https://github.com/authzed/spicedb/releases/tag/v1.52.0
	security-advisories@github.com	https://github.com/authzed/spicedb/security/advisories/GHSA-mqcf-gqvg-rmhm

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "spicedb",
          "vendor": "authzed",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.15.0, \u003c 1.52.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SpiceDB is an open source database system for creating and managing security-critical application permissions. From version 1.15.0 to before version 1.52.0, caveat structures with nested lists can result in improper cache reuse. This issue has been patched in version 1.52.0."
    }
  ],
  "id": "CVE-2026-46668",
  "lastModified": "2026-06-17T10:53:49.583",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 2.3,
          "baseSeverity": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-46668",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-11T12:29:29.612397Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-10T22:16:59.893",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/authzed/spicedb/pull/3065"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/authzed/spicedb/releases/tag/v1.52.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/authzed/spicedb/security/advisories/GHSA-mqcf-gqvg-rmhm"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-MQCF-GQVG-RMHM

Vulnerability from github – Published: 2026-05-21 20:28 – Updated: 2026-06-11 14:05

Summary

SpiceDB: Caveat structures with nested lists can result in improper cache reuse

Details

Impact

Users are impacted if:

They have a caveat structure with a nested list, e.g.:

zed caveat shape(x list<any>) { x == [["a"], "b"] } - Their system exercises that caveat with either CheckBulkPermission or else LookupResources running with the --experimental-lookup-resources-version flag set to lr3, implying they are using the experimental version 3 of LookupResources - An attacker can cause the system to craft a request to SpiceDB where either: 1. It's a CheckBulk request where there are two check items that are identical except for their combined caveat context, and one of the caveat contexts evaluates positively and the other evaluates negatively 2. It's a LookupResources request where two resources have the same evaluation contents except for their caveat context, and one would evaluate positively and the other would evaluate negatively

If all of the above are true, it would be possible for SpiceDB to erroneously return that a user has access to a resource that they do not have access to.

Patches

This problem was addressed in https://github.com/authzed/spicedb/pull/3065 and released in version v1.52.0.

Workarounds

If using v3 of LookupResources, turn the flag off.

If possible, refactor the caveat declaration structure so that it does not operate on a list of lists, but rather any other composite structure.

Severity

2.3 (Low)


                  
                    CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/authzed/spicedb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.15.0"
            },
            {
              "fixed": "1.52.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-46668"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-21T20:28:43Z",
    "nvd_published_at": "2026-06-10T22:16:59Z",
    "severity": "LOW"
  },
  "details": "### Impact\nUsers are impacted if:\n\n- They have a caveat structure with a nested list, e.g.:\n  \n```zed\n  caveat shape(x list\u003cany\u003e) {\n    x == [[\"a\"], \"b\"]\n  }\n  ```\n- Their system exercises that caveat with either [CheckBulkPermission](https://buf.build/authzed/api/docs/main%3Aauthzed.api.v1#authzed.api.v1.PermissionsService.CheckBulkPermissions) or else [LookupResources](https://buf.build/authzed/api/docs/main%3Aauthzed.api.v1#authzed.api.v1.PermissionsService.LookupResources) running with the `--experimental-lookup-resources-version` flag set to `lr3`, implying they are using the experimental version 3 of `LookupResources`\n-  An attacker can cause the system to craft a request to SpiceDB where either:\n    1. It\u0027s a `CheckBulk` request where there are two check items that are identical except for their combined caveat context, and one of the caveat contexts evaluates positively and the other evaluates negatively\n    2. It\u0027s a `LookupResources` request where two resources have the same evaluation contents except for their caveat context, and one would evaluate positively and the other would evaluate negatively\n\nIf all of the above are true, it would be possible for SpiceDB to erroneously return that a user has access to a resource that they do not have access to.\n\n### Patches\nThis problem was addressed in https://github.com/authzed/spicedb/pull/3065 and released in version v1.52.0.\n\n### Workarounds\nIf using v3 of `LookupResources`, turn the flag off.\n\nIf possible, refactor the `caveat` declaration structure so that it does not operate on a list of lists, but rather any other composite structure.",
  "id": "GHSA-mqcf-gqvg-rmhm",
  "modified": "2026-06-11T14:05:32Z",
  "published": "2026-05-21T20:28:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/authzed/spicedb/security/advisories/GHSA-mqcf-gqvg-rmhm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46668"
    },
    {
      "type": "WEB",
      "url": "https://github.com/authzed/spicedb/pull/3065"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/authzed/spicedb"
    },
    {
      "type": "WEB",
      "url": "https://github.com/authzed/spicedb/releases/tag/v1.52.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "SpiceDB: Caveat structures with nested lists can result in improper cache reuse"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-46668 (GCVE-0-2026-46668)

FKIE_CVE-2026-46668

GHSA-MQCF-GQVG-RMHM

Impact

Patches

Workarounds

Tags

Sightings

Nomenclature