Authzed's vulnerability footprint centers on SpiceDB, a specialized open-source authorization and permission-management system that addresses access-control logic across distributed applications. The vendor's durable exposure pattern reflects the operational and information-handling demands of an authorization service: recurring weaknesses include sensitive information leakage into logs and error messages, resource-exhaustion conditions, and encoding edge cases that are characteristic of systems handling permission queries at scale. Current severity, exploitation, and exposure figures are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Authzed over time
Signals from CVEs in this vendor scope (13 CVEs).
13 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-21646HIGH SpiceDB is a database system for managing security-critical application permissions. Any user making use of a wildcard relationship under the right hand branch of an `exclusion` or | Jan 11, 2022 | 8.1 | 26 | NO | NO |
CVE-2024-27101CRITICAL SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Integer overflow in chunking helper causes dispatc | Mar 1, 2024 | 9.1 | 25 | NO | NO |
CVE-2023-29193HIGH SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. The `spicedb serve` command contains a fla | Apr 14, 2023 | 7.5 | 24 | NO | NO |
CVE-2025-64529MEDIUM SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions prior to 1.45.2, users who use the exclusion operator som | Nov 10, 2025 | 6.5 | 20 | NO | NO |
CVE-2023-46255MEDIUM SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Prior to version 1.27.0-rc1, when the provided dat | Oct 31, 2023 | 6.5 | 19 | NO | NO |
CVE-2026-40091MEDIUM SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.51.0, when SpiceDB starts with log level | Apr 15, 2026 | 4.4 | 18 | NO | NO |
CVE-2025-65111MEDIUM SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to version 1.47.1, if a schema includes the following character | Nov 21, 2025 | 5.3 | 18 | NO | NO |
CVE-2025-49011MEDIUM SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats on the arrow’ed relat | Jun 6, 2025 | 5.3 | 17 | NO | NO |
CVE-2024-38361MEDIUM Spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Use of an exclusion under an arrow that has | Jun 20, 2024 | 5.3 | 17 | NO | NO |
CVE-2024-46989MEDIUM spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Multiple caveats over the same indirect sub | Sep 18, 2024 | 5.3 | 16 | NO | NO |
Signals from CVEs in this vendor scope (13 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Authzed.
Media articles that mention a CVE ID that affects a product developed by Authzed — matched by CVE ID, not by vendor name.