CVE-2025-65111: low-severity vulnerability in authzed spicedb
SpiceDB's LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 2.9epss 0.2%
SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to version 1.47.1, if a schema includes the following characteristics: permission defined in terms of a union (+) and that union references the same relation on both sides (but one side arrows to a different permission). Then SpiceDB may have missing LookupResources results when checking the permission. This only affects LookupResources; other APIs calculate permissionship correctly. The issue is fixed in version 1.47.1.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
authzed · spicedbRelated CVEs — authzed spicedb
In the same product, most dangerous first.
CVE-2022-21646HIGHLookup operations do not take into account wildcards in SpiceDBEPSS 1.3%CVE-2023-29193HIGHSpiceDB binding metrics port to untrusted networks and can leak command-line flagsEPSS 0.8%CVE-2024-32001LOWSpiceDB: LookupSubjects may return partial results if a specific kind of relation is usedEPSS 0.6%CVE-2024-27101HIGHInteger overflow in chunking helper causes dispatching to miss elements or panicEPSS 0.5%CVE-2023-35930LOWLookupResources may return partial results in spicedbEPSS 0.4%CVE-2023-46255MEDIUM`SPICEDB_DATASTORE_CONN_URI` is leaked when URI cannot be parsedEPSS 0.4%