{"id":"CVE-2025-65111","aliases":["GHSA-9m7r-g8hg-x3vr","GO-2025-4151"],"url":"https://o3.security/vulnerability/CVE-2025-65111","summary":"SpiceDB's LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results","details":"### Impact\n\nIf your schema includes the following characteristics:\n\n1. You have a permission defined in terms of a union (`+`)\n1. That union references the same relation on both sides, but one side arrows to a different permission\n\nThen you might have missing `LookupResources` results when checking the permission. This only affects `LookupResources`; other APIs calculate permissionship correctly.\n\nA small concrete example:\n\n```\nrelation doer_of_things: user | group#member\npermission do_the_thing = doer_of_things + doer_of_things->admin\n```\n\nA CheckPermission on `do_the_thing` will return the correct permissionship, but a LookupResources on `do_the_thing` may miss resources.\n\n#### A Comprehensive Example\n\nIf you have a schema with a structure like this:\n\n```\ndefinition special_user {}\n\ndefinition user {\n  relation special_user_mapping: special_user\n  permission special_user = special_user_mapping\n}\ndefinition group {\n   relation member: user\n   permission membership = member + member->special_user\n}\n\ndefinition system {\n  relation viewer: user | group#membership\n  // This is the problematic permission\n  permission view = viewer + viewer->special_user\n}\n```\n\nAnd these relationships:\n```\nsystem:somesystem#viewer@group:somegroup#membership\ngroup:somegroup#member@user:someuser1\nuser:someuser1#special_user_mapping@special_user:specialuser\n```\n\nAnd you call LookupResources with:\n```\nsubject_type: user\nsubject_id: someuser1\npermission: view\nresource_type: system\n```\n\nYou would expect to receive `system:somesystem` in the results, but you do not.\n\nNote that this only applies to `LookupResources`; if you `CheckPermission` for that resource specifically, it will return `HasPermission`.\n\n### Patches\n\nThe issue is fixed in v1.47.1. Upgrading to this version will remediate this issue.\n\n### Workarounds\nN/A\n\n### References\nN/A","published":"2025-11-21T22:02:52.563Z","modified":"2026-08-12T03:51:49.250470708Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/authzed/spicedb","fixedVersion":"1.47.1"}],"fix":{"url":"https://github.com/authzed/spicedb/commit/8c2edbe1e7bd3851fa2138f4cc344bfde986dcf2","label":"authzed/spicedb@8c2edbe"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65111.json"},{"type":"ADVISORY","url":"https://github.com/authzed/spicedb/security/advisories/GHSA-9m7r-g8hg-x3vr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65111"},{"type":"FIX","url":"https://github.com/authzed/spicedb/commit/8c2edbe1e7bd3851fa2138f4cc344bfde986dcf2"},{"type":"PACKAGE","url":"https://github.com/authzed/spicedb"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:49.250470708Z"}}