CVE-2026-46668

SpiceDB: Caveat structures with nested lists can result in improper cache reuse

State: Published
Severity: 2.3 Low
Published: Jun 10, 2026
Updated: Jun 11, 2026
Reserved: May 15, 2026

Description

SpiceDB is an open source database system for creating and managing security-critical application permissions. From version 1.15.0 to before version 1.52.0, caveat structures with nested lists can result in improper cache reuse. This issue has been patched in version 1.52.0.

Scores

CVSS	Score	Vector	Source
4.0	2.3 Low	CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-285 Improper Authorization

Affected Products

Product	Versions
spicedbauthzed	>= 1.15.0, < 1.52.0Affected

References

https://github.com/authzed/spicedb/security/advisories/GHSA-mqcf-gqvg-rmhm
https://github.com/authzed/spicedb/pull/3065
https://github.com/authzed/spicedb/releases/tag/v1.52.0

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.