Security Vulnerability in SpiceDB Affects Permission Management Features
CVE-2025-65111

2.9LOW

Key Information:

Vendor

Authzed

Status
Spicedb
Vendor
CVE Published:
21 November 2025

What is CVE-2025-65111?

An issue exists in SpiceDB, an open source database focused on managing permissions for security-critical applications. The vulnerability arises when a schema defines a permission using a union that references the same relation on both sides while differing in permissions. This specific schema configuration can lead to missing results in the LookupResources API when checking permissions. Other APIs within SpiceDB perform as expected and calculate permissions correctly. The issue is addressed in version 1.47.1 of SpiceDB.

Affected Version(s)

spicedb < 1.47.1

References

https://github.com/authzed/spicedb/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/authzed/spicedb/commit/8c2edbe1e7bd385...
x_refsource_MISC

CVSS V4

Score:
2.9
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-65111 : Security Vulnerability in SpiceDB Affects Permission Management Features