PT-2026-42696 · Go+1 · Github.Com/Authzed/Spicedb+1

Published 2026-05-21 · Updated 2026-06-10 · CVE-2026-46668

Positive Technologies (AI Summary)

CVSS v4.0

2.3

Low

Base vector

AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions SpiceDB versions 1.15.0 through 1.51.x

Description Caveat structures containing nested lists can lead to improper cache reuse. This occurs when the system processes these structures using the 'CheckBulkPermissions' endpoint or the 'LookupResources' endpoint while the --experimental-lookup-resources-version flag is set to lr3. An attacker could potentially trigger a request where identical check items or resources differ only by their caveat context, causing the system to erroneously grant access to a resource that the user should not be able to access.

Recommendations Update to version 1.52.0. Disable the --experimental-lookup-resources-version flag if using version 3 of 'LookupResources'. Refactor the caveat declaration structure to avoid using lists of lists, utilizing other composite structures instead.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-46668

GHSA-MQCF-GQVG-RMHM

Affected Products

Github.Com/Authzed/Spicedb

Spicedb

References · 6

• https://osv.dev/vulnerability/GHSA-mqcf-gqvg-rmhm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46668 · Security Note
• https://github.com/authzed/spicedb/pull/3065 · Note
• https://github.com/authzed/spicedb/security/advisories/GHSA-mqcf-gqvg-rmhm · Note
• https://github.com/authzed/spicedb/releases/tag/v1.52.0 · Note
• https://github.com/authzed/spicedb · Note