{"schemaVersion":3,"id":"CVE-2022-21646","aliases":["GHSA-7p8f-8hjm-wm92","GO-2022-0295"],"status":"published","duplicateOf":null,"title":null,"description":"SpiceDB is a database system for managing security-critical application permissions. Any user making use of a wildcard relationship under the right hand branch of an `exclusion` or within an `intersection` operation will see `Lookup`/`LookupResources` return a resource as \"accessible\" if it is *not* accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion. In `v1.3.0`, the wildcard is ignored entirely in lookup's dispatch, resulting in the `banned` wildcard being ignored in the exclusion. Version 1.4.0 contains a patch for this issue. As a workaround, don't make use of wildcards on the right side of intersections or within exclusions.","dates":{"published":"2022-01-11T21:50:10.000Z","modified":"2025-04-23T19:13:28.941Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.1,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Go","score":8.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","exploitability":7.2,"impact":8.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":5.5,"severity":"medium","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.01278,"percentile":0.69559,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.01278},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01278,"percentile":0.69559}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01278,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01278,"percentile":0.69559}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-20","name":"Improper Input Validation","description":"The product receives input or data, but it does\n        not validate or incorrectly validates that the input has the\n        properties that are required to process the data safely and\n        correctly.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/20.html"},{"id":"CWE-155","name":"Improper Neutralization of Wildcards or Matching Symbols","description":"The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as wildcards or matching symbols when they are sent to a downstream component.","type":"weakness","status":"Draft","abstraction":"Variant","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/155.html"}],"affected":[{"vendor":"authzed","product":"spicedb","name":"spicedb","label":"spicedb","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"= 1.3.0","noFixRecorded":false,"fixedIn":null},{"text":"1.3.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"= 1.3.0 | 1.3.0","eol":null,"hubHref":"/vendor/authzed/spicedb"},{"vendor":"github.com/authzed","product":"spicedb","name":"github.com/authzed/spicedb","label":"spicedb","ecosystem":"Go","cpePart":null,"purl":"pkg:golang/github.com/authzed/spicedb","purlType":"golang","versions":[{"text":"≥ 1.3.0, < 1.4.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 1.3.0, < 1.4.0","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/authzed/spicedb/security/advisories/GHSA-7p8f-8hjm-wm92","label":"github.com/authzed/spicedb/security/advisories/GHSA-7p8f-8hjm-wm92","hostname":"github.com","tags":["X Refsource CONFIRM","WEB","Advisory","Third Party Advisory"]},{"url":"https://github.com/authzed/spicedb/issues/358","label":"github.com/authzed/spicedb/issues/358","hostname":"github.com","tags":["X Refsource MISC","WEB","REPORT","Third Party Advisory"]},{"url":"https://github.com/authzed/spicedb/commit/15bba2e2d2a4bda336a37a7fe8ef8a35028cd970","label":"github.com/authzed/spicedb/commit/15bba2e2d2a4bda336a37a7fe8ef8a35028cd970","hostname":"github.com","tags":["X Refsource MISC","WEB","FIX","Patch","Third Party Advisory"]},{"url":"https://github.com/authzed/spicedb/releases/tag/v1.4.0","label":"github.com/authzed/spicedb/releases/tag/v1.4.0","hostname":"github.com","tags":["X Refsource MISC","WEB","Release Notes","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21646","label":"nvd.nist.gov/vuln/detail/CVE-2022-21646","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/authzed/spicedb","label":"github.com/authzed/spicedb","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2022-01-11T21:50:10.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-04-23T19:13:28.941Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":33,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T23:50:16.474Z","stale":false,"partial":false}}