GHSA-m54h-5x5f-5m6r SpiceDB's LookupResources may return partial results

• Go github.com/authzed/spicedb: >= 1.22.0, < 1.22.2 → fixed in 1.22.2

Impact Any user making a negative authorization decision based on the results of a LookupResources request with 1.22.0 is affected. For example, using `LookupResources` to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using `LookupResources` to find a list of banned resources instead, then some users that shouldn't have access may. Generally, `LookupResources` is not and should not be used to gate access in this way - that's what the `Check` API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release. Workarounds Avoid using `LookupResources` for negative authorization decisions if using `1.22.0`. Patches The only affected release is v1.22.0, and it is patched in v1.22.2 (there is no v1.22.1 release, though there is a git tag). References • https://github.com/authzed/spicedb/pull/1397 For more information If you have any questions or comments about this advisory: • Open an issue in SpiceDB • Ask a question in the SpiceDB Discord