https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T20:06:08.780140+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-199816 EUVD-2026-199816 2026-10-03T20:06:08.783064+00:00 EUVD-2026-199816 https://cve.radiocsirt.org/vuln/fkie_cve-2023-35930 fkie_cve-2023-35930 2026-10-03T20:06:08.783096+00:00

SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. Any user making a negative authorization decision based on the results of a `LookupResources` request with 1.22.0 is affected. For example, using `LookupResources` to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using `LookupResources` to find a list of banned resources instead, then some users that shouldn't have access may. Generally, `LookupResources` is not and should not be to gate access in this way - that's what the `Check` API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release. Users are advised to upgrade to version 1.22.2. Users unable to upgrade should avoid using `LookupResources` for negative authorization decisions.

 https://cve.radiocsirt.org/vuln/ghsa-m54h-5x5f-5m6r GHSA-m54h-5x5f-5m6r — SpiceDB's LookupResources may return partial results 2026-10-03T20:06:08.783131+00:00

Affected: Go: github.com/authzed/spicedb

### Impact Any user making a negative authorization decision based on the results of a LookupResources request with 1.22.0 is affected.

For example, using `LookupResources` to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using `LookupResources` to find a list of banned resources instead, then some users that shouldn't have access may.

Generally, `LookupResources` is not and should not be used to gate access in this way - that's what the `Check` API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release.

### Workarounds Avoid using `LookupResources` for negative authorization decisions if using `1.22.0`.

### Patches The only affected release is [v1.22.0](https://github.com/authzed/spicedb/releases/tag/v1.22.0), and it is patched in [v1.22.2](https://github.com/authzed/spicedb/releases/tag/v1.22.2) (there is no v1.22.1 release, though there is a git tag).

### References - https://github.com/authzed/spicedb/pull/1397

### For more information If you have any questions or comments about this advisory: * Open an issue in [SpiceDB](https://github.com/authzed/spicedb) * Ask a question in the [SpiceDB Discord](https://authzed.com/discord)

 https://cve.radiocsirt.org/vuln/gsd-2023-35930 gsd-2023-35930 2026-10-03T20:06:08.783168+00:00 gsd-2023-35930