CVE-2025-65111: Authzed SpiceDB incomplete LookupResources results in complex schemas

CVE-2025-65111 · Severity: medium · CVSS 5.3 · Published 2025-11-21

SpiceDB is a database used to manage and check user permissions within applications. A flaw in how it searches for resources means that in certain complex configurations, it may fail to list all the items a user actually has permission to access. While this does not allow unauthorized access, it can cause applications to behave incorrectly by hiding data or options that should be visible to the user.

Technologies: Authzed SpiceDB, github.com/authzed/spicedb (Go). Vendors: Authzed, Go.

Quick answers

Is CVE-2025-65111 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-65111 being exploited in the wild.
How severe is CVE-2025-65111?
Medium severity, with a CVSS score of 5.3, published 21 November 2025.
Which products and versions are affected?
Authzed SpiceDB < 1.47.1; github.com/authzed/spicedb (Go) < 1.47.1, SEMVER:introduced=0,fixed=1.47.1.
Is there a fix for CVE-2025-65111?
Yes. github.com/authzed/spicedb (Go): upgrade to 1.47.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-65111 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2025-65111?
Check whether you run Authzed SpiceDB or github.com/authzed/spicedb (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/authzed/spicedb (Go): upgrade to 1.47.1 or later
    go get github.com/authzed/spicedb@v1.47.1

Technical details

A vulnerability in SpiceDB's reachability graph and query planner causes incomplete results in the LookupResources API. The issue occurs when a permission is defined as a union (+) where both sides reference the same relation, but one side uses an arrow (->) to reference a different permission. This configuration causes the engine to skip necessary entrypoint computations in the reachability graph. While LookupResources may fail to return all valid resources, the CheckPermission API remains unaffected and correctly validates access. The issue is resolved in version 1.47.1 by fixing the entrypoint computation logic.

Affected products

  • Authzed SpiceDB < 1.47.1

Identifiers

  • CVE-2025-65111
  • GHSA-9m7r-g8hg-x3vr
  • GO-2025-4151

Timeline

  • 2025-11-20: patched: Fix committed to repository
  • 2025-11-21: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.