cve.bz

CVE-2025-65111

2.9 lowEPSS 0.2%

SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to version 1.47.1, if a schema includes the following characteristics: permission defined in terms of a union (+) and that union references the same relation on both sides (but one side arrows to a different permission). Then SpiceDB may have missing LookupResources results when checking the permission. This only affects LookupResources; other APIs calculate permissionship correctly. The issue is fixed in version 1.47.1.

CVSS 4.0
2.9CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
CVSS 3.1
5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS
0.2% chance of exploitation in the next 30 days; higher than 14% of CVEs (scores of 2026-10-25)
CWE
CWE-277
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-9m7r-g8hg-x3vrGogithub.com/authzed/spicedb<1.47.11.47.1
GO-2025-4151Gogithub.com/authzed/spicedb<1.47.11.47.1

References

Check your stackJSON