CVE-2025-65111
published 2025-11-21CVE-2025-65111: SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to version 1.47.1, if a schema includes…
PriorityP428medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.19%
9.3th percentile
SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to version 1.47.1, if a schema includes the following characteristics: permission defined in terms of a union (+) and that union references the same relation on both sides (but one side arrows to a different permission). Then SpiceDB may have missing LookupResources results when checking the permission. This only affects LookupResources; other APIs calculate permissionship correctly. The issue is fixed in version 1.47.1.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| authzed | spicedb | < 1.47.1 | 1.47.1 |
| github.com | authzed_spicedb | >= 0 < 1.47.1 | 1.47.1 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvdv4.02.9LOWCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results in github.com/authzed/spicedb
osv·2025-11-25
CVE-2025-65111 SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results in github.com/authzed/spicedb
SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results in github.com/authzed/spicedb
SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results in github.com/authzed/spicedb
OSV
SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results
osv·2025-11-21
CVE-2025-65111 [LOW] SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results
SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results
### Impact
If a schema includes the following characteristics:
1. Permission defined in terms of a union (`+`)
1. That union references the same relation on both sides, but one side arrows to a different permission
Then you might have missing `LookupResources` results when checking the permission. This only affects `LookupResources`; other APIs calculate permissionship correctly.
A small concrete example:
```
relation doer_of_things: user | group#member
permission do_the_thing = doer_of_things + doer_of_things->admin
```
A CheckPermission on `do_the_thing` will return the correct permissionship, but a LookupResources on `do_the_thing` may miss resources.
#### A Comprehensiv
GHSA
SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results
ghsa·2025-11-21
CVE-2025-65111 [LOW] CWE-277 SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results
SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results
### Impact
If a schema includes the following characteristics:
1. Permission defined in terms of a union (`+`)
1. That union references the same relation on both sides, but one side arrows to a different permission
Then you might have missing `LookupResources` results when checking the permission. This only affects `LookupResources`; other APIs calculate permissionship correctly.
A small concrete example:
```
relation doer_of_things: user | group#member
permission do_the_thing = doer_of_things + doer_of_things->admin
```
A CheckPermission on `do_the_thing` will return the correct permissionship, but a LookupResources on `do_the_thing` may miss resources.
#### A Comprehensiv
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-11-21
Published