Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15 results
Sep 14, 2026SpiceDB is an open source database system for creating and managing security-critical application permissions.CVE-2026-55866 · Other software · authzed · reported by GitHubLow 3.7
SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIP_HAS_PERMISSION instead of PERMISSIONSHIP_CONDITIONAL_PERMISSION or PERMISSIONSHIP_NO_PERMISSION because checkRequestToKey() and checkRequestToKeyWithCanonical() in internal/dispatch/keys/computed.go omit CheckHints when constructing dispatch Check cache keys. The incorrect result requires a permission combining relations with intersection or exclusion, a subject reachable through caveated and non-caveated branches, LookupResources with a context parameter running concurrently with CheckPermission or CheckBulkPermissions for the same resource and subject, and an enabled dispatch result cache. Under these conditions, a result computed for one hint set can poison the cache entry used by a semantically different authorization check, allowing permission without satisfying the caveat. This issue is fixed in version 1.54.0.
- Product
- spicedb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026SpiceDB is an open source database system for creating and managing security-critical application permissions.CVE-2026-46668 · Other software · authzed · reported by GitHubLow 2.3
SpiceDB is an open source database system for creating and managing security-critical application permissions. From version 1.15.0 to before version 1.52.0, caveat structures with nested lists can result in improper cache reuse. This issue has been patched in version 1.52.0.
- Product
- spicedb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2026SpiceDB is an open source database system for creating and managing security-critical application permissions.CVE-2026-40091 · Other software · authzed · reported by GitHubMedium 6
SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.51.0, when SpiceDB starts with log level info, the startup "configuration" log will include the full datastore DSN, including the plaintext password, inside DatastoreConfig.URI. This issue has been fixed in version 1.51.1. If users are unable to immediately upgrade, they can work around this issue by changing the log level to warn or error.
- Product
- spicedb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2025SpiceDB is an open source database system for creating and managing security-critical application permissions.CVE-2025-65111 · Other software · authzed · reported by GitHubLow 2.9
SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to version 1.47.1, if a schema includes the following characteristics: permission defined in terms of a union (+) and that union references the same relation on both sides (but one side arrows to a different permission). Then SpiceDB may have missing LookupResources results when checking the permission. This only affects LookupResources; other APIs calculate permissionship correctly. The issue is fixed in version 1.47.1.
- Product
- spicedb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2025SpiceDB is an open source database system for creating and managing security-critical application permissions.CVE-2025-64529 · Other software · authzed · reported by GitHubLow 2.7
SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions prior to 1.45.2, users who use the exclusion operator somewhere in their authorization schema; have configured their SpiceDB server such that `--write-relationships-max-updates-per-call` is bigger than 6500; and issue calls to WriteRelationships with a large enough number of updates that cause the payload to be bigger than what their datastore allows; will receive a successful response from their `WriteRelationships` call, when in reality that call failed, and receive incorrect permission check results, if those relationships had to be read to resolve the relation involving the exclusion. Version 1.45.2 contains a patch for the issue. As a workaround, set `--write-relationships-max-updates-per-call` to `1000`.
- Product
- spicedb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2025SpiceDB is an open source database for storing and querying fine-grained authorization data.CVE-2025-49011 · Other software · authzed · reported by GitHubLow 3.7
SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected. Version 1.44.2 fixes the issue. As a workaround, do not use caveats in the schema over an arrow’ed relation.
- Product
- spicedb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2024SpiceDB is an open source database for scalably storing and querying fine-grained authorization data.CVE-2024-48909 · Other software · authzed · reported by GitHubLow 2
SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior to version 1.37.1, clients that have enabled `LookupResources2` and have caveats in the evaluation path for their requests can return a permissionship of `CONDITIONAL` with context marked as missing, even then the context was supplied. LookupResources2 is the new default in SpiceDB 1.37.0 and has been opt-in since SpiceDB 1.35.0. The bug is patched as part of SpiceDB 1.37.1. As a workaround, disable LookupResources2 via the `--enable-experimental-lookup-resources` flag by setting it to `false`.
- Product
- spicedb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2024spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications.CVE-2024-46989 · Other software · authzed · reported by GitHubLow 3.7
spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Multiple caveats over the same indirect subject type on the same relation can result in no permission being returned when permission is expected. If the resource has multiple groups, and each group is caveated, it is possible for the returned permission to be "no permission" when permission is expected. Permission is returned as NO_PERMISSION when PERMISSION is expected on the CheckPermission API. This issue has been addressed in release version 1.35.3. Users are advised to upgrade. Users unable to upgrade should not use caveats or avoid the use of caveats on an indirect subject type with multiple entries.
- Product
- spicedb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2024Spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications.CVE-2024-38361 · Other software · authzed · reported by GitHubLow 3.7
Spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Use of an exclusion under an arrow that has multiple resources may resolve to `NO_PERMISSION` when permission is expected. If the resource exists under *multiple* folders and the user has access to view more than a single folder, SpiceDB may report the user does not have access due to a failure in the exclusion dispatcher to request that *all* the folders in which the user is a member be returned. Permission is returned as `NO_PERMISSION` when `PERMISSION` is expected on the `CheckPermission` API. This issue has been addressed in version 1.33.1. All users are advised to upgrade. There are no known workarounds for this issue.
- Product
- spicedb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2024SpiceDB is a graph database purpose-built for storing and evaluating access control data.CVE-2024-32001 · Other software · authzed · reported by GitHubLow 2.2
SpiceDB is a graph database purpose-built for storing and evaluating access control data. Use of a relation of the form: `relation folder: folder | folder#parent` with an arrow such as `folder->view` can cause LookupSubjects to only return the subjects found under subjects for either `folder` or `folder#parent`. This bug only manifests if the same subject type is used multiple types in a relation, relationships exist for both subject types and an arrow is used over the relation. Any user making a negative authorization decision based on the results of a LookupSubjects request with version before v1.30.1 is affected. Version 1.30.1 contains a patch for the issue. As a workaround, avoid using LookupSubjects for negative authorization decisions and/or avoid using the broken schema.
- Product
- spicedb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2024SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions.CVE-2024-27101 · Other software · authzed · reported by GitHubHigh 7.3
SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Integer overflow in chunking helper causes dispatching to miss elements or panic. Any SpiceDB cluster with any schema where a resource being checked has more than 65535 relationships for the same resource and subject type is affected by this problem. The CheckPermission, BulkCheckPermission, and LookupSubjects API methods are affected. This vulnerability is fixed in 1.29.2.
- Product
- spicedb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2023SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions.CVE-2023-46255 · Other software · authzed · reported by GitHubMedium 4.2
SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Prior to version 1.27.0-rc1, when the provided datastore URI is malformed (e.g. by having a password which contains `:`) the full URI (including the provided password) is printed, so that the password is shown in the logs. Version 1.27.0-rc1 patches this issue.
- Product
- spicedb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2023SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions.CVE-2023-35930 · Other software · authzed · reported by GitHubLow 3.7
SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. Any user making a negative authorization decision based on the results of a `LookupResources` request with 1.22.0 is affected. For example, using `LookupResources` to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using `LookupResources` to find a list of banned resources instead, then some users that shouldn't have access may. Generally, `LookupResources` is not and should not be to gate access in this way - that's what the `Check` API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release. Users are advised to upgrade to version 1.22.2. Users unable to upgrade should avoid using `LookupResources` for negative authorization decisions.
- Product
- spicedb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2023SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions.CVE-2023-29193 · Other software · authzed · reported by GitHubHigh 8.7
SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. The `spicedb serve` command contains a flag named `--grpc-preshared-key` which is used to protect the gRPC API from being accessed by unauthorized requests. The values of this flag are to be considered sensitive, secret data. The `/debug/pprof/cmdline` endpoint served by the metrics service (defaulting running on port `9090`) reveals the command-line flags provided for debugging purposes. If a password is set via the `--grpc-preshared-key` then the key is revealed by this endpoint along with any other flags provided to the SpiceDB binary. This issue has been fixed in version 1.19.1. ### Impact All deployments abiding by the recommended best practices for production usage are **NOT affected**: - Authzed's SpiceDB Serverless - Authzed's SpiceDB Dedicated - SpiceDB Operator Users configuring SpiceDB via environment variables are **NOT affected**. Users **MAY be affected** if they expose their metrics port to an untrusted network and are configuring `--grpc-preshared-key` via command-line flag. ### Patches TODO ### Workarounds To workaround t
- Product
- spicedb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2022SpiceDB is a database system for managing security-critical application permissions.CVE-2022-21646 · Other software · authzed · reported by GitHubHigh 8.1
SpiceDB is a database system for managing security-critical application permissions. Any user making use of a wildcard relationship under the right hand branch of an `exclusion` or within an `intersection` operation will see `Lookup`/`LookupResources` return a resource as "accessible" if it is *not* accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion. In `v1.3.0`, the wildcard is ignored entirely in lookup's dispatch, resulting in the `banned` wildcard being ignored in the exclusion. Version 1.4.0 contains a patch for this issue. As a workaround, don't make use of wildcards on the right side of intersections or within exclusions.
- Product
- spicedb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.