CVE-2022-21646

    Dashboard / Vulnerabilities / CVE-2022-21646

    CVE-2022-21646

    Published: 11 Jan 2022Last Modified: 12 Aug 2026

    Summary: Lookup operations do not take into account wildcards in SpiceDB

    Details: SpiceDB is a database system for managing security-critical application permissions. Any user making use of a wildcard relationship under the right hand branch of an `exclusion` or within an `intersection` operation will see `Lookup`/`LookupResources` return a resource as "accessible" if it is *not* accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion. In `v1.3.0`, the wildcard is ignored entirely in lookup's dispatch, resulting in the `banned` wildcard being ignored in the exclusion. Version 1.4.0 contains a patch for this issue. As a workaround, don't make use of wildcards on the right side of intersections or within exclusions.

    References: https://github.com/authzed/spicedb/releases/tag/v1.4.0, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21646.json, https://github.com/authzed/spicedb/security/advisories/GHSA-7p8f-8hjm-wm92, https://nvd.nist.gov/vuln/detail/CVE-2022-21646, https://github.com/authzed/spicedb/issues/358, https://github.com/authzed/spicedb/commit/15bba2e2d2a4bda336a37a7fe8ef8a35028cd970

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 10616c73e4dfcebb282372ec8d4d878cf220ec94
    Fixed -15bba2e2d2a4bda336a37a7fe8ef8a35028cd970

    Affected versions

    1.3.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-21646 | CVE-DB