Executive brief
SpiceDB, a database used for managing application permissions, contains a flaw where certain updates to access rules may appear successful even if they failed to save. This occurs when a large number of permission changes are sent in a single request, potentially leading to incorrect authorization decisions. In practice, this means users might be granted or denied access based on outdated or missing security rules, compromising the integrity of the system's access controls.
Technical details
A vulnerability in SpiceDB's WriteRelationships API occurs when the number of updates in a single call exceeds the underlying datastore's payload limits, particularly when the '--write-relationships-max-updates-per-call' configuration is set above 6500. Due to missing error checks in the datastore layer (specifically affecting Postgres and potentially other backends), the system returns a successful response even if the transaction failed. This results in data inconsistency that affects authorization logic, especially when using the exclusion operator in schemas. Attackers or automated systems issuing large batches of relationship updates can trigger this state without authentication if the API is exposed. The issue is fixed in version 1.45.2 by adding proper error propagation.
Affected products
- Authzed SpiceDB < 1.45.2
Timeline
- 2025-11-10: advisory: Initial disclosure by Authzed
- 2025-11-10: patched: Fix released in version 1.45.2
- 2025-11-13: disclosed: GitHub Advisory published