Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-65111

SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to version 1.47.1, if a schema includes the following characteristics: permission defined in terms of a union (+) and that union references the same relation on both sides (but one side arrows to a different permission). Then SpiceDB may have missing LookupResources results when checking the permission. This only affects LookupResources; other APIs calculate permissionship correctly. The issue is fixed in version 1.47.1.

Published

2025-11-21T22:16:33.697

Last Modified

2025-12-31T13:41:21.827

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 5.3 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-277
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application authzed spicedb < 1.47.1 Yes
References