CVE-2022-21646
Lookup operations do not take into account wildcards in SpiceDB
SpiceDB is a database system for managing security-critical application permissions. Any user making use of a wildcard relationship under the right hand branch of an exclusion or within an intersection operation will see Lookup/LookupResources return a resource as "accessible" if it is not accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion. In v1.3.0, the wildcard is ignored entirely in lookup's dispatch, resulting in the banned wildcard being ignored in the exclusion. Version 1.4.0 contains a patch for this issue. As a workaround, don't make use of wildcards on the right side of intersections or within exclusions.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Lookup operations do not take into account wildcards in SpiceDB
SpiceDB is a database system for managing security-critical application permissions. Any user making use of a wildcard relationship under the right hand branch of an exclusion or within an intersection operation will see Lookup/LookupResources return a resource as "accessible" if it is not accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion. In v1.3.0, the wildcard is ignored entirely in lookup's dispatch, resulting in the banned wildcard being ignored in the exclusion. Version 1.4.0 contains a patch for this issue. As a workaround, don't make use of wildcards on the right side of intersections or within exclusions.
- Record
CVE-2022-21646- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-155, CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2022-0503
SpiceDB is a database system for managing security-critical application permissions. Any user making use of a wildcard relationship under the right hand branch of an exclusion or within an intersection operation will see Lookup/LookupResources return a resource as "accessible" if it is not accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion. In v1.3.0, the wildcard is ignored entirely in lookup's dispatch, resulting in the banned wildcard being ignored in the exclusion. Version 1.4.0 contains a patch for this issue. As a workaround, don't make use of wildcards on the right side of intersections or within exclusions.
- Record
EUVD-2022-0503- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7p8f-8hjm-wm92
Lookup operations do not take into account wildcards in SpiceDB
Impact
Any user making use of a wildcard relationship under the right hand branch of an exclusion or within an intersection operation will see Lookup/LookupResources return a resource as "accessible" if it is not accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion.
For example, given schema:
definition user {}
definition resource {
relation viewer: user
relation banned: user | user:*
permission view = viewer - banned
}
If user:* is placed into the banned relation for a particular resource, view should return false for all resources. in v1.3.0, the wildcard is ignored entirely in lookup's dispatch, resulting in the banned wildcard being ignored in the exclusion.
Workarounds
Don't make use of wildcards on the right side of intersections or within exclusions.
References
https://github.com/authzed/spicedb/issues/358
For more information
If you have any questions or comments about this advisory:
- Open an issue in SpiceDB
- Ask a question in the SpiceDB Discord
- Record
GHSA-7p8f-8hjm-wm92- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-20, CWE-155
- Updated
- 2026-11-02
NVD
SpiceDB is a database system for managing security-critical application permissions. Any user making use of a wildcard relationship under the right hand branch of an exclusion or within an intersection operation will see Lookup/LookupResources return a resource as "accessible" if it is not accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion. In v1.3.0, the wildcard is ignored entirely in lookup's dispatch, resulting in the banned wildcard being ignored in the exclusion. Version 1.4.0 contains a patch for this issue. As a workaround, don't make use of wildcards on the right side of intersections or within exclusions.
- Record
CVE-2022-21646- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - CVSS 2.0
- 5.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:N - Weakness
- CWE-20, CWE-155
- Updated
- 2026-11-02
OSV
Lookup operations do not take into account wildcards in SpiceDB
SpiceDB is a database system for managing security-critical application permissions. Any user making use of a wildcard relationship under the right hand branch of an exclusion or within an intersection operation will see Lookup/LookupResources return a resource as "accessible" if it is not accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion. In v1.3.0, the wildcard is ignored entirely in lookup's dispatch, resulting in the banned wildcard being ignored in the exclusion. Version 1.4.0 contains a patch for this issue. As a workaround, don't make use of wildcards on the right side of intersections or within exclusions.
- Record
CVE-2022-21646- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-155, CWE-20
- Updated
- 2026-11-02
OSVGHSA-7p8f-8hjm-wm92
Lookup operations do not take into account wildcards in SpiceDB
Impact
Any user making use of a wildcard relationship under the right hand branch of an exclusion or within an intersection operation will see Lookup/LookupResources return a resource as "accessible" if it is not accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion.
For example, given schema:
definition user {}
definition resource {
relation viewer: user
relation banned: user | user:*
permission view = viewer - banned
}
If user:* is placed into the banned relation for a particular resource, view should return false for all resources. in v1.3.0, the wildcard is ignored entirely in lookup's dispatch, resulting in the banned wildcard being ignored in the exclusion.
Workarounds
Don't make use of wildcards on the right side of intersections or within exclusions.
References
https://github.com/authzed/spicedb/issues/358
For more information
If you have any questions or comments about this advisory:
- Open an issue in SpiceDB
- Ask a question in the SpiceDB Discord
- Record
GHSA-7p8f-8hjm-wm92- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-155, CWE-20
- Updated
- 2026-11-02
OSVGO-2022-0295 No score
Lookup operations do not take into account wildcards in SpiceDB in github.com/authzed/spicedb
Lookup operations do not take into account wildcards in SpiceDB in github.com/authzed/spicedb
- Record
GO-2022-0295- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/authzed/spicedbGo |
1.3.0 to 1.3.0 | 1.4.0 |
github.com/authzed/spicedbGo |
1.3.0 up to 1.4.0 | 1.4.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-21646 is a high vulnerability (CVSS 8.1) in Authzed Spicedb, published January 11, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.32%, the 70th percentile. Fixed in github.com/authzed/spicedb 1.4.0.
References
github.com/authzed/spicedb/security/advisories/GHSA-7p8f-8hjm-wm92
nvd.nist.gov/vuln/detail/CVE-2022-21646