CVE-2023-35930
mediumpriority · track · 21EPSS 0.004 · 39 %ileEUUSEPSS · scored 2026-10-27
SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. Any user making a negative authorization decision based on the results of a `LookupResources` request with 1.22.0 is affected. For example, using `LookupResources` to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using `LookupResources` to find a list of banned resources instead, then some users that shouldn't have access may. Generally, `LookupResources` is not and should not be to gate access in this way - that's what the `Check` API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release. Users are advised to upgrade to version 1.22.2. Users unable to upgrade should avoid using `LookupResources` for negative authorization decisions.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 3.7–5.3
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-m54h-5x5f-5m6rSpiceDB's LookupResources may return partial results2023-06-28ghsa · osvUS
### Impact Any user making a negative authorization decision based on the results of a LookupResources request with 1.22.0 is affected. For example, using `LookupResources` to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using `LookupResources` to find a list of banned resources instead, then some users that shouldn't have access may. Generally, `LookupResources` is not and should not be used to gate access in this way - that's what the `Check` API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release. ### Workarounds Avoid using `LookupResources` for negative authorization decisions if using `1.22.0`. ### Patches The only affected release is [v1.22.0](https://github.com/authzed/spicedb/releases/tag/v1.22.0), and it is patched in [v1.22.2](https://github.com/authzed/spicedb/releases/tag/v1.22.2) (there is no v1.22.1 release, though there is a git tag). ### References - https://github.com/authzed/spicedb/pull/1397 ### For more information If you have any questions or comments about this advisory: * Open an issue in [SpiceDB](https://github.com/authzed/spicedb) * Ask a question in the [SpiceDB Discord](https://authzed.com/discord)
- GO-2023-1871SpiceDB's LookupResources may return partial results in github.com/authzed/spicedb2024-08-20vendor · osvUS
SpiceDB's LookupResources may return partial results in github.com/authzed/spicedb
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2023-35930/cnnvd
- https://github.com/authzed/spicedb/pull/1397cnnvd
- https://github.com/authzed/spicedb/security/advisories/GHSA-m54h-5x5f-5m6rcnnvd
- https://github.com/authzed/spicedb/pull/1397enisa_euvd
- https://github.com/authzed/spicedb/security/advisories/GHSA-m54h-5x5f-5m6renisa_euvd
- https://github.com/authzed/spicedb/pull/1397PatchVendor Advisorynvd
- https://github.com/authzed/spicedb/security/advisories/GHSA-m54h-5x5f-5m6rPatchVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan