cve.bz

CVE-2026-46668

2.3 lowEPSS 0.3%

Low (2.3). EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/authzed/spicedb 1.52.0.

SpiceDB is an open source database system for creating and managing security-critical application permissions. From version 1.15.0 to before version 1.52.0, caveat structures with nested lists can result in improper cache reuse. This issue has been patched in version 1.52.0.

Severity

CVSS 4.0

2.3 low
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.3% chance of exploitation in the next 30 days; higher than 20% of CVEs (scores of 2026-10-31)
CWE
CWE-285
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-mqcf-gqvg-rmhmGogithub.com/authzed/spicedb>=1.15.0 <1.52.01.52.0
GO-2026-5514Gogithub.com/authzed/spicedb>=1.15.0 <1.52.01.52.0

References

Check your stackJSON