Cloudanix VulnDB

CVE-2025-65111

Medium · 5.3

SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results

CVSS

5.3

EPSS

0.2%

Published

Nov 21, 2025

CISA due date

—

The record

If a schema includes the following characteristics: 1. Permission defined in terms of a union (`+`) 1. That union references the same relation on both sides, but one side arrows to a different permission Then you might have missing `LookupResources` results when checking the permission. This only affects `LookupResources`; other APIs calculate permissionship correctly. A small concrete example: ``` relation doer_of_things: user | group#member permission do_the_thing = doer_of_things + doer_of_things->admin ``` A CheckPermission on `do_the_thing` will return the correct permissionship, but a LookupResources on `do_the_thing` may miss resources.

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/authzed/spicedb 0 1.47.1
SUSE:Linux Enterprise Module for Package Hub 15 SP6 govulncheck-vulndb 0 0.0.20251209T172047-150000.1.127.1
openSUSE:Leap 15.6 govulncheck-vulndb 0 0.0.20251209T172047-150000.1.127.1

Related vulnerabilities