2.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-65111

CVE-2025-65111: SpiceDB's LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results

SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to version 1.47.1, if a schema includes the following characteristics: permission defined in terms of a union (+) and that union references the same relation on both sides (but one side arrows to a different permission). Then SpiceDB may have missing LookupResources results when checking the permission. This only affects LookupResources; other APIs calculate permissionship correctly. The issue is fixed in version 1.47.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-65111

CVE-2025-65111:

2.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/authzed/spicedb	go	< 1.47.1	1.47.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability in SpiceDB's LookupResources API (GHSA-9m7r-g8hg-x3vr) caused it to return incomplete results for certain schema configurations. My analysis of the patch reveals two underlying logical flaws that were fixed.

First, in pkg/schema/reachabilitygraph.go, the collectEntrypoints function used an overly aggressive memoization strategy. When a permission involved a union that referenced the same relation in multiple ways (e.g., permission view = viewer + viewer->special_user), the function would prematurely stop its analysis after encountering the viewer relation the first time. This prevented it from discovering the additional path through the viewer->special_user arrow, leading to an incomplete set of entrypoints for the LookupResources query.

Second, in pkg/query/build_tree.go, the buildArrowIterators and buildIntersectionArrowIterators functions, which build the query plan, did not correctly handle relations that could resolve to multiple types (e.g., relation viewer: user | group). If an arrow was applied to such a relation, and the target of the arrow did not exist on all of the possible types, the function would error out instead of correctly treating it as an empty result for the non-applicable types. This error would halt query construction for that path, again leading to incomplete results.

The patch addresses both issues by refining the memoization logic in collectEntrypoints to allow for the exploration of all paths and by making the arrow-building functions correctly handle multi-typed relations by treating missing arrow targets as empty sets. These changes ensure that the query planner and reachability analysis can correctly process these complex schema structures, remediating the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.