CVE-2025-65111
📋 TL;DR
This vulnerability in SpiceDB causes missing LookupResources results when checking permissions defined with specific union relationships in schemas. It allows applications to incorrectly determine users don't have access to resources they should be able to access. Only affects systems using SpiceDB with schemas containing the described union pattern.
💻 Affected Systems
- SpiceDB
📦 What is this software?
Spicedb by Authzed
⚠️ Risk & Real-World Impact
Worst Case
Authorization bypass where users are incorrectly denied access to resources they should have permission to access, potentially disrupting critical business operations.
Likely Case
Intermittent authorization failures where legitimate users cannot access resources they should have permission to access, leading to application errors and user complaints.
If Mitigated
Authorization failures limited to specific resource types defined with the problematic union pattern, with other permission checks functioning normally.
🎯 Exploit Status
Exploitation requires knowledge of the specific schema structure and access to make LookupResources API calls.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.47.1
Vendor Advisory: https://github.com/authzed/spicedb/security/advisories/GHSA-9m7r-g8hg-x3vr
Restart Required: Yes
Instructions:
1. Update SpiceDB to version 1.47.1 or later
2. Restart the SpiceDB service
3. Verify the update was successful
🔧 Temporary Workarounds
Schema modification
allModify schemas to avoid union permissions that reference the same relation on both sides with different permission arrows
🧯 If You Can't Patch
- Audit schemas for union permissions referencing same relation on both sides and modify them
- Implement additional authorization checks outside of LookupResources API
🔍 How to Verify
Check if Vulnerable:
Check if SpiceDB version is below 1.47.1 and review schemas for union permissions with the described patternCheck Version:
spicedb versionVerify Fix Applied:
Verify SpiceDB version is 1.47.1 or later and test LookupResources API with previously problematic schemas📡 Detection & Monitoring
Log Indicators:
- Increased LookupResources API errors
- Authorization failures for users with valid permissions
Network Indicators:
- SpiceDB API calls returning unexpected empty results for LookupResources
SIEM Query:
Look for SpiceDB logs containing 'LookupResources' with error patterns or unexpected empty results