Authzed SpiceDB 1.3.0
Approved changes feed: RSS · Atom
cpe:2.3:a:authzed:spicedb:1.3.0:*:*:*:*:*:*:*
part: a version: 1.3.0 update: *
| Vendor | Authzed (db17206a-8610-5cf1-b7bf-7e2a9029ab8d) |
|---|---|
| Product | Spicedb (e6a2ac40-dfe3-5a18-876e-cafd50af5073) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:docker/authzed/spicedb |
purl2cpe | 2026-06-01 10:15:22.331922 |
pkg:github/authzed/spicedb |
purl2cpe | 2026-06-01 10:15:22.331923 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2022-21646 |
vulnerable | 2026-06-08 05:40:01.920263 |
Lookup operations do not take into account wildcards in SpiceDB
HIGH (8.1)
SpiceDB is a database system for managing security-critical application permissions. Any user making use of a wildcard relationship under the right hand branch of an `exclusion` or within an `intersection` operation will see `Lookup`/`LookupResources` return a resource as "accessible" if it is *not* accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion. In `v1.3.0`, the wildcard is ignored entirely in lookup's dispatch, resulting in the `banned` wildcard being ignored in the exclusion. Version 1.4.0 contains a patch for this issue. As a workaround, don't make use of wildcards on the right side of intersections or within exclusions.
Published: 2022-01-11T21:50:10.000Z
Updated: 2025-04-23T19:13:28.941Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.