{"schema_version":"1.7.5","id":"GHSA-9m7r-g8hg-x3vr","published":"2025-11-21T18:06:00Z","modified":"2026-05-14T21:03:52.519592Z","aliases":["CVE-2025-65111","GO-2025-4151"],"summary":"SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results","details":"### Impact\n\nIf your schema includes the following characteristics:\n\n1. You have a permission defined in terms of a union (`+`)\n1. That union references the same relation on both sides, but one side arrows to a different permission\n\nThen you might have missing `LookupResources` results when checking the permission. This only affects `LookupResources`; other APIs calculate permissionship correctly.\n\nA small concrete example:\n\n```\nrelation doer_of_things: user | group#member\npermission do_the_thing = doer_of_things + doer_of_things->admin\n```\n\nA CheckPermission on `do_the_thing` will return the correct permissionship, but a LookupResources on `do_the_thing` may miss resources.\n\n#### A Comprehensive Example\n\nIf you have a schema with a structure like this:\n\n```\ndefinition special_user {}\n\ndefinition user {\n  relation special_user_mapping: special_user\n  permission special_user = special_user_mapping\n}\ndefinition group {\n   relation member: user\n   permission membership = member + member->special_user\n}\n\ndefinition system {\n  relation viewer: user | group#membership\n  // This is the problematic permission\n  permission view = viewer + viewer->special_user\n}\n```\n\nAnd these relationships:\n```\nsystem:somesystem#viewer@group:somegroup#membership\ngroup:somegroup#member@user:someuser1\nuser:someuser1#special_user_mapping@special_user:specialuser\n```\n\nAnd you call LookupResources with:\n```\nsubject_type: user\nsubject_id: someuser1\npermission: view\nresource_type: system\n```\n\nYou would expect to receive `system:somesystem` in the results, but you do not.\n\nNote that this only applies to `LookupResources`; if you `CheckPermission` for that resource specifically, it will return `HasPermission`.\n\n### Patches\n\nThe issue is fixed in v1.47.1. Upgrading to this version will remediate this issue.\n\n### Workarounds\nN/A\n\n### References\nN/A","affected":[{"package":{"name":"github.com/authzed/spicedb","ecosystem":"Go","purl":"pkg:golang/github.com/authzed/spicedb"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.47.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-9m7r-g8hg-x3vr/GHSA-9m7r-g8hg-x3vr.json"}}],"references":[{"type":"WEB","url":"https://github.com/authzed/spicedb/security/advisories/GHSA-9m7r-g8hg-x3vr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65111"},{"type":"WEB","url":"https://github.com/authzed/spicedb/commit/8c2edbe1e7bd3851fa2138f4cc344bfde986dcf2"},{"type":"PACKAGE","url":"https://github.com/authzed/spicedb"}],"database_specific":{"cwe_ids":["CWE-277"],"github_reviewed":true,"github_reviewed_at":"2025-11-21T18:06:00Z","nvd_published_at":"2025-11-21T22:16:33Z","severity":"LOW"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}]}