authzed spicedb up to 1.47.0 insecure inherited permissions

Summaryinfo

A vulnerability has been found in authzed spicedb up to 1.47.0 and classified as problematic. This impacts an unknown function. The manipulation leads to insecure inherited permissions. This vulnerability is uniquely identified as CVE-2025-65111. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in authzed spicedb up to 1.47.0. It has been rated as problematic. This issue affects an unknown part. The manipulation with an unknown input leads to a insecure inherited permissions vulnerability. Using CWE to declare the problem leads to CWE-277. A product defines a set of insecure permissions that are inherited by objects that are created by the program. Impacted is integrity. The summary by CVE is:

SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to version 1.47.1, if a schema includes the following characteristics: permission defined in terms of a union (+) and that union references the same relation on both sides (but one side arrows to a different permission). Then SpiceDB may have missing LookupResources results when checking the permission. This only affects LookupResources; other APIs calculate permissionship correctly. The issue is fixed in version 1.47.1.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2025-65111 since 11/17/2025. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1222 according to MITRE ATT&CK.

Upgrading to version 1.47.1 eliminates this vulnerability. Applying the patch 8c2edbe1e7bd3851fa2138f4cc344bfde986dcf2 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• authzed

Name

• spicedb

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35
• 1.36
• 1.37
• 1.38
• 1.39
• 1.40
• 1.41
• 1.42
• 1.43
• 1.44
• 1.45
• 1.46
• 1.47.0

License

• open-source

Website

• Product: https://github.com/authzed/spicedb/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion