CVE-2025-65111
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to version 1.47.1, if a schema includes the following characteristics: permission defined in terms of a union (+) and that union references the same relation on both sides (but one side arrows to a different permission). Then SpiceDB may have missing LookupResources results when checking the permission. This only affects LookupResources; other APIs calculate permissionship correctly. The issue is fixed in version 1.47.1.
Risk Assessment
Missing LookupResources results can lead to incorrect authorization decisions, potentially allowing unauthorized access to resources. This can compromise the integrity of the permission system.
Recommendation
Update SpiceDB to version 1.47.1 or later, which fixes this vulnerability. If an update is not possible, review schemas for the mentioned characteristics and consider temporary workarounds.
Other vulnerabilities in SpiceDB
See all- CVE-2026-55866Low
SpiceDB from 1.34.0 until 1.54.0 can return PERMISSIONSHIP_HAS_PERMISSION instead of PERMISSIONSHIP_CONDITIONAL_PERMISSION or PERMISSIONSHIP_NO_PERMISSION because checkRequestToKey() and checkRequestToKeyWithCanonical() in internal/dispatch/keys/computed.go omit CheckHints when constructing dispatch Check cache keys. A result computed for one hint set can poison the cache entry used by a semantically different authorization check.
- CVE-2026-46668Low
In SpiceDB from version 1.15.0 to before 1.52.0, caveat structures with nested lists can result in improper cache reuse. This issue has been patched in version 1.52.0.
- CVE-2023-35930Low
SpiceDB, a Google Zanzibar-inspired database system, has an issue with negative authorization decisions using the `LookupResources` request in version 1.22.0. Users may incorrectly gain access to resources that should be blocked.
Original NVD description (English source)
SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to version 1.47.1, if a schema includes the following characteristics: permission defined in terms of a union (+) and that union references the same relation on both sides (but one side arrows to a different permission). Then SpiceDB may have missing LookupResources results when checking the permission. This only affects LookupResources; other APIs calculate permissionship correctly. The issue is fixed in version 1.47.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS