CVE-2022-21646
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-21646
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-21646.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2022-21646
- Aliases
- Published
- 2022-01-11T21:50:10Z
- Modified
- 2025-10-30T19:58:18.814292Z
- Severity
-
- 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- Lookup operations do not take into account wildcards in SpiceDB
- Details
-
SpiceDB is a database system for managing security-critical application permissions. Any user making use of a wildcard relationship under the right hand branch of an
exclusionor within anintersectionoperation will seeLookup/LookupResourcesreturn a resource as "accessible" if it is not accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion. Inv1.3.0, the wildcard is ignored entirely in lookup's dispatch, resulting in thebannedwildcard being ignored in the exclusion. Version 1.4.0 contains a patch for this issue. As a workaround, don't make use of wildcards on the right side of intersections or within exclusions. - Database specific
{ "cwe_ids": [ "CWE-155", "CWE-20" ] }- References