CVE-2025-65111
Medium
Description
SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to version 1.47.1, if a schema includes the following characteristics: permission defined in terms of a union (+) and that union references the same relation on both sides (but one side arrows to a different permission). Then SpiceDB may have missing LookupResources results when checking the permission. This only affects LookupResources; other APIs calculate permissionship correctly. The issue is fixed in version 1.47.1.
SeverityMedium
CVSS5.3
Exploit probability—
ProductAuthzed Spicedb
PublishedNov 21, 2025
First seenNov 21, 2025
Weakness typeCWE-277CWE-277
How to fix
Update
- authzed spicedb1.47.1 or later
- github.com/authzed/spicedb1.47.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| authzed spicedb | v < 1.47.1 | 1.47.1 |
| github.com/authzed/spicedbGo | v < 1.47.1 | 1.47.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.