CVE-2025-64529: Authzed SpiceDB Privilege Escalation Flaw

CVE-2025-64529 Overview

CVE-2025-64529 affects SpiceDB, an open source database for managing security-critical application permissions. Versions prior to 1.45.2 return successful responses for WriteRelationships calls that actually failed at the datastore layer. The flaw triggers when operators use the exclusion operator in their authorization schema, configure --write-relationships-max-updates-per-call above 6500, and submit payloads exceeding datastore size limits. Subsequent permission checks that rely on those relationships return incorrect results. The issue maps to [CWE-770] (Allocation of Resources Without Limits or Throttling) and is tracked under the vendor advisory GHSA-pm3x-jrhh-qcr7.

Critical Impact
Silent write failures cause SpiceDB to return incorrect permission check results, potentially granting or denying access contrary to the intended authorization policy.

Affected Products

Authzed SpiceDB versions prior to 1.45.2
Deployments using the exclusion operator in the authorization schema
Deployments with --write-relationships-max-updates-per-call configured above 6500

Discovery Timeline

2025-11-10 - CVE-2025-64529 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64529

Vulnerability Analysis

SpiceDB accepts WriteRelationships calls containing batched updates up to the value of --write-relationships-max-updates-per-call. When that limit exceeds 6500, the resulting payload can surpass the maximum transaction or statement size enforced by the backing datastore. SpiceDB does not surface the datastore rejection to the caller. Instead, the client receives a successful response indicating the writes were committed.

Downstream permission checks then read those relationships to evaluate schemas containing the exclusion operator. Because the relationships were never persisted, the exclusion resolves against stale or missing data. The service returns permission decisions that do not reflect the caller's intended policy state.

The EPSS score is 0.22% (12.4 percentile), and no public exploit is available.

Root Cause

The vulnerability stems from missing error propagation between the datastore layer and the API response path. SpiceDB does not validate the aggregate payload size against datastore constraints before issuing the write. When the datastore rejects the transaction, the failure is not translated into an error return to the gRPC caller.

Attack Vector

The issue is reachable over the network by any client authorized to issue WriteRelationships calls. Exploitation does not require authentication bypass or specialized tooling. A caller only needs to submit an update batch large enough to exceed the datastore payload limit against a vulnerable configuration. The impact is limited to integrity and availability of permission decisions, with no direct confidentiality loss.

The vulnerability is described in prose only. Refer to the SpiceDB Security Advisory GHSA-pm3x-jrhh-qcr7 for maintainer-authored technical details.

Detection Methods for CVE-2025-64529

Indicators of Compromise

SpiceDB server logs showing datastore-level errors on transaction commit that do not correlate with client-visible WriteRelationships failures.
Discrepancies between the count of relationships expected to exist after a batch write and results returned by ReadRelationships.
Permission check outcomes that contradict recently issued WriteRelationships responses for schemas using the exclusion operator.

Detection Strategies

Audit the running SpiceDB configuration for --write-relationships-max-updates-per-call values greater than 6500.
Inventory authorization schemas and flag any use of the exclusion operator (-) in relation definitions.
Correlate application-side write confirmations with datastore transaction logs to identify silent commit failures.

Monitoring Recommendations

Emit metrics on WriteRelationships payload sizes and alert when batches approach datastore transaction limits.
Monitor SpiceDB error logs for datastore driver exceptions such as PostgreSQL row is too big or CockroachDB transaction size errors.
Track permission check anomalies where recently written relationships fail to influence decision outcomes.

How to Mitigate CVE-2025-64529

Immediate Actions Required

Upgrade SpiceDB to version 1.45.2 or later, which contains the patch for this issue.
If immediate upgrade is not possible, set --write-relationships-max-updates-per-call to 1000 as directed by the vendor advisory.
Review recent WriteRelationships operations against schemas using the exclusion operator to identify potentially lost writes.

Patch Information

The fix is available in SpiceDB 1.45.2. Details are published in the vendor advisory GHSA-pm3x-jrhh-qcr7. Operators should validate the deployed binary version after upgrade and rerun any batch writes that may have failed silently under the vulnerable configuration.

Workarounds

Set the --write-relationships-max-updates-per-call flag to 1000 to keep payloads below datastore transaction limits.
Split large WriteRelationships calls into smaller batches on the client side.
Add client-side verification by issuing ReadRelationships after critical batch writes to confirm persistence.

bash

# Configuration example: reduce batch size as a workaround
spicedb serve \
  --grpc-preshared-key "$SPICEDB_KEY" \
  --datastore-engine postgres \
  --datastore-conn-uri "$DATASTORE_URI" \
  --write-relationships-max-updates-per-call 1000