CVE-2025-64529
📋 TL;DR
SpiceDB versions before 1.45.2 have a vulnerability where WriteRelationships calls with large payloads can return success when they actually failed, leading to incorrect permission check results. This affects users who use the exclusion operator in their authorization schema and have configured --write-relationships-max-updates-per-call above 6500. The vulnerability allows authorization logic to be bypassed.
💻 Affected Systems
- SpiceDB
📦 What is this software?
Spicedb by Authzed
⚠️ Risk & Real-World Impact
Worst Case
Authorization bypass leading to unauthorized access to protected resources, data leakage, or privilege escalation in security-critical applications.
Likely Case
Inconsistent permission checks causing application logic errors, potentially allowing some users to access resources they shouldn't have access to.
If Mitigated
No impact if proper version or workaround is applied; otherwise, potential authorization inconsistencies.
🎯 Exploit Status
Exploitation requires specific configuration conditions and understanding of the authorization schema. Attacker needs ability to make WriteRelationships calls.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.45.2
Vendor Advisory: https://github.com/authzed/spicedb/security/advisories/GHSA-pm3x-jrhh-qcr7
Restart Required: Yes
Instructions:
1. Update SpiceDB to version 1.45.2 or later. 2. Restart the SpiceDB service. 3. Verify the version is 1.45.2+ using spicedb version command.
🔧 Temporary Workarounds
Limit WriteRelationships updates
allSet --write-relationships-max-updates-per-call to 1000 or lower to prevent the condition that triggers the vulnerability
spicedb serve --write-relationships-max-updates-per-call=1000
🧯 If You Can't Patch
- Apply the workaround by setting --write-relationships-max-updates-per-call to 1000 or lower
- Monitor WriteRelationships calls for failures and implement additional validation logic in application layer
🔍 How to Verify
Check if Vulnerable:
Check if SpiceDB version is below 1.45.2 AND --write-relationships-max-updates-per-call > 6500 AND exclusion operator is used in schemaCheck Version:
spicedb versionVerify Fix Applied:
Verify version is 1.45.2 or higher using spicedb version command📡 Detection & Monitoring
Log Indicators:
- WriteRelationships calls with large payloads returning success but no actual database updates
- Permission check inconsistencies for resources using exclusion operator
Network Indicators:
- Large WriteRelationships API calls to SpiceDB
- Unusual pattern of permission check failures/successes
SIEM Query:
source="spicedb" AND ("WriteRelationships" AND "exclusion") AND size>6500