CVE-2023-35930

    Dashboard / Vulnerabilities / CVE-2023-35930

    CVE-2023-35930

    Published: 26 Jun 2023Last Modified: 12 Aug 2026

    Summary: LookupResources may return partial results in spicedb

    Details: SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. Any user making a negative authorization decision based on the results of a `LookupResources` request with 1.22.0 is affected. For example, using `LookupResources` to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using `LookupResources` to find a list of banned resources instead, then some users that shouldn't have access may. Generally, `LookupResources` is not and should not be to gate access in this way - that's what the `Check` API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release. Users are advised to upgrade to version 1.22.2. Users unable to upgrade should avoid using `LookupResources` for negative authorization decisions.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35930.json, https://github.com/authzed/spicedb/security/advisories/GHSA-m54h-5x5f-5m6r, https://nvd.nist.gov/vuln/detail/CVE-2023-35930, https://github.com/authzed/spicedb/pull/1397

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 374cd7e5db8e460381016859eae1a7de3e760414
    Fixed -None

    Affected versions

    1.22.0-NA

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-35930 | CVE-DB