{"id":"EUVD-2025-198499","enisaUuid":"8d5a370c-d575-3f0b-95e2-3e9ccea316e0","description":"SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to version 1.47.1, if a schema includes the following characteristics: permission defined in terms of a union (+) and that union references the same relation on both sides (but one side arrows to a different permission). Then SpiceDB may have missing LookupResources results when checking the permission. This only affects LookupResources; other APIs calculate permissionship correctly. The issue is fixed in version 1.47.1.","datePublished":"Nov 21, 2025, 10:02:52 PM","dateUpdated":"Nov 24, 2025, 5:50:51 PM","baseScore":2.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","references":"https://github.com/authzed/spicedb/security/advisories/GHSA-9m7r-g8hg-x3vr\nhttps://github.com/authzed/spicedb/commit/8c2edbe1e7bd3851fa2138f4cc344bfde986dcf2\n","aliases":"CVE-2025-65111\nGHSA-9m7r-g8hg-x3vr\n","assigner":"GitHub_M","epss":0.23,"enisaIdProduct":[{"id":"b04ccaf8-8215-3c37-93d5-9f4ee99db7d1","product":{"name":"spicedb","vendor":{"name":"authzed"}},"product_version":"\u003c 1.47.1"}],"enisaIdVendor":[{"id":"a5c5b54c-8066-3ba2-9b31-4a40f60b28e4","vendor":{"name":"authzed"}}],"enisaIdVulnerability":[{"id":"ec8fbb5c-58b3-3458-9899-636a1f15f8e6","vulnerability":{"id":"CVE-2025-65111","description":"SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to version 1.47.1, if a schema includes the following characteristics: permission defined in terms of a union (+) and that union references the same relation on both sides (but one side arrows to a different permission). Then SpiceDB may have missing LookupResources results when checking the permission. This only affects LookupResources; other APIs calculate permissionship correctly. The issue is fixed in version 1.47.1.","datePublished":"Nov 21, 2025, 10:02:52 PM","dateUpdated":"Nov 24, 2025, 5:50:51 PM","status":"PUBLISHED","baseScore":2.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","references":"https://github.com/authzed/spicedb/security/advisories/GHSA-9m7r-g8hg-x3vr\nhttps://github.com/authzed/spicedb/commit/8c2edbe1e7bd3851fa2138f4cc344bfde986dcf2\n","enisa_id":"EUVD-2025-198499\n","assigner":"GitHub_M","epss":0.23,"dataProcessed":"Oct 27, 2026, 7:20:15 AM","vulnerabilityProduct":[{"id":"0101bf17-6237-326d-808f-1acc385221d8","product":{"name":"spicedb","vendor":{"name":"authzed"}},"product_version":"\u003c 1.47.1"}],"vulnerabilityVendor":[{"id":"7d2cf23e-4349-3ab7-b7d4-3faf20006361","vendor":{"name":"authzed"}}]}},{"id":"fdd8ba05-d7f2-335b-b2e0-26a91ecd3d3b","vulnerability":{"id":"GHSA-9m7r-g8hg-x3vr","description":"SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results","datePublished":"Nov 21, 2025, 6:06:00 PM","dateUpdated":"May 14, 2026, 8:54:49 PM","baseScore":0.0,"references":"https://github.com/authzed/spicedb/security/advisories/GHSA-9m7r-g8hg-x3vr\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-65111\nhttps://github.com/authzed/spicedb/commit/8c2edbe1e7bd3851fa2138f4cc344bfde986dcf2\nhttps://github.com/authzed/spicedb\n","enisa_id":"EUVD-2025-198499\n","aliases":"GHSA-9m7r-g8hg-x3vr\nCVE-2025-65111\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:51:54 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}