CVE-2025-65111: SpiceDB Incomplete LookupResources Results Due to Permission Schema Issue
Summary
CVE-2025-65111: Impact If a schema includes the following characteristics: 1. Affects github.com/authzed/spicedb versions < 1.47.1. Fixed in 1.47.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
SpiceDB is an open-source database designed for managing permissions and access control in applications. It allows developers to define complex permission schemas using relations and permissions. However, certain schema configurations can lead to incomplete results when using the LookupResources API, which is critical for retrieving resources based on permissions.
Vulnerability Detail
The vulnerability arises when a schema defines permissions using a union that references the same relation on both sides, but one side points to a different permission. This can lead to missing results in LookupResources calls, even though CheckPermission calls return correct permissions. For instance, if a user is expected to have access to a resource based on their permissions, the LookupResources API may not return that resource, leading to potential access issues.
How To Fix
Latest published version: v1.57.0 as of 23 Oct 2026
go get github.com/authzed/spicedb@v1.57.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.47.1
This is the first release that contains the fix.
go get github.com/authzed/spicedb@v1.47.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to upgrade to the patched version as soon as possible.
Conclusion
In summary, CVE-2025-65111 affects SpiceDB by causing incomplete results in the LookupResources API due to specific permission schema configurations. Upgrading to version 1.47.1 is essential to mitigate this vulnerability and ensure proper access control in applications using SpiceDB.
See every vulnerability recorded for github.com/authzed/spicedb →
FAQ
The vulnerability can lead to missing resources in LookupResources calls, which may affect access control in applications relying on SpiceDB.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By using the Vulert playground, you can check if your application is affected by this vulnerability without any signup.
While there are no specific workarounds, it is recommended to prioritize upgrading to the patched version to ensure your application is secure.
No, this issue specifically affects the LookupResources API. Other APIs, such as CheckPermission, calculate permissions correctly.
The vulnerability has been classified with a low severity rating, but it can still lead to significant access control issues if not addressed.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/authzed/spicedb.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
