Is CVE-2025-64529 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-64529 being exploited in the wild.

How severe is CVE-2025-64529?

Medium severity, with a CVSS score of 6.5, published 13 November 2025.

Which products and versions are affected?

Authzed SpiceDB < 1.45.2; github.com/authzed/spicedb (Go) < 1.45.2, SEMVER:introduced=0,fixed=1.45.2.

Is there a fix for CVE-2025-64529?

Yes. github.com/authzed/spicedb (Go): upgrade to 1.45.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-64529 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-64529?

Check whether you run Authzed SpiceDB or github.com/authzed/spicedb (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-64529: Authzed SpiceDB silent failure in WriteRelationships

Q: Which products and versions are affected?

Authzed SpiceDB < 1.45.2; github.com/authzed/spicedb (Go) < 1.45.2, SEMVER:introduced=0,fixed=1.45.2.

Q: Is there a fix for CVE-2025-64529?

Yes. github.com/authzed/spicedb (Go): upgrade to 1.45.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-64529 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2025-64529?

Check whether you run Authzed SpiceDB or github.com/authzed/spicedb (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-64529 · Severity: medium · CVSS 6.5 · Published 2025-11-13

SpiceDB, a database used for managing application permissions, contains a flaw where certain updates to access rules may appear successful even if they failed to save. This occurs when a large number of permission changes are sent in a single request, potentially leading to incorrect authorization decisions. In practice, this means users might be granted or denied access based on outdated or missing security rules, compromising the integrity of the system's access controls.

Technologies: Authzed SpiceDB, github.com/authzed/spicedb (Go). Vendors: Authzed, Go.

Quick answers

Is CVE-2025-64529 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-64529 being exploited in the wild.
How severe is CVE-2025-64529?: Medium severity, with a CVSS score of 6.5, published 13 November 2025.
Which products and versions are affected?: Authzed SpiceDB < 1.45.2; github.com/authzed/spicedb (Go) < 1.45.2, SEMVER:introduced=0,fixed=1.45.2.
Is there a fix for CVE-2025-64529?: Yes. github.com/authzed/spicedb (Go): upgrade to 1.45.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-64529 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-64529?: Check whether you run Authzed SpiceDB or github.com/authzed/spicedb (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/authzed/spicedb (Go): upgrade to 1.45.2 or later
```
go get github.com/authzed/spicedb@v1.45.2
```

Technical details

A vulnerability in SpiceDB's WriteRelationships API occurs when the number of updates in a single call exceeds the underlying datastore's payload limits, particularly when the '--write-relationships-max-updates-per-call' configuration is set above 6500. Due to missing error checks in the datastore layer (specifically affecting Postgres and potentially other backends), the system returns a successful response even if the transaction failed. This results in data inconsistency that affects authorization logic, especially when using the exclusion operator in schemas. Attackers or automated systems issuing large batches of relationship updates can trigger this state without authentication if the API is exposed. The issue is fixed in version 1.45.2 by adding proper error propagation.

Affected products

Authzed SpiceDB < 1.45.2

Identifiers

CVE-2025-64529
GHSA-pm3x-jrhh-qcr7
GO-2025-4120

Timeline

2025-11-10: advisory: Initial disclosure by Authzed
2025-11-10: patched: Fix released in version 1.45.2
2025-11-13: disclosed: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.