CVE-2025-64529: 
NixOS vulnerability analysis and mitigation

CVE-2025-64529 is a logic error in SpiceDB, an open-source database system for managing application permissions, that causes WriteRelationships calls to silently fail and return a false success response when the payload exceeds datastore limits. This results in incorrect permission check results for relations involving the exclusion operator. The vulnerability affects all SpiceDB versions prior to 1.45.2 and was disclosed on November 10, 2025. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 2.7 (Low) (GitHub Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling): when --write-relationships-max-updates-per-call is configured above 6500, a WriteRelationships RPC call carrying a payload larger than the datastore's maximum silently fails at the datastore layer but returns a success response to the caller. Because the relationships are never actually written, any subsequent permission checks that rely on those relationships — specifically those involving the exclusion operator (-) in the authorization schema — will evaluate against stale or missing data, producing incorrect (overly permissive or overly restrictive) results. The flaw requires no authentication to trigger over the network, though it does require the ability to issue WriteRelationships calls. The fix is tracked in commit d0cd103 of the authzed/spicedb repository (GitHub Advisory, SpiceDB Advisory).

The primary consequence is incorrect authorization decisions: relationships that were supposed to be written but silently failed will cause permission checks involving the exclusion operator to return wrong results, potentially granting unauthorized access to protected resources or incorrectly denying legitimate access. Integrity and availability are both rated as low-impact, with no confidentiality impact, as the vulnerability does not directly expose data but can undermine the correctness of the entire permission model for affected relations. In environments where SpiceDB is the authoritative authorization layer, this could allow privilege escalation or access bypass for any resource whose permissions depend on exclusion-based rules (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.084% (24th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the ability to issue WriteRelationships API calls to a misconfigured SpiceDB instance (with --write-relationships-max-updates-per-call > 6500) and knowledge of the schema's use of the exclusion operator (GitHub Advisory).

1. Reconnaissance: Identify a SpiceDB deployment where --write-relationships-max-updates-per-call is configured above 6500 and the authorization schema uses the exclusion operator (-) in one or more relation definitions.
2. Craft oversized payload: Construct a WriteRelationships gRPC request containing more than ~6500 relationship updates, ensuring the total payload size exceeds the configured datastore limit (e.g., PostgreSQL's maximum transaction size).
3. Issue the call: Send the oversized WriteRelationships request to the SpiceDB gRPC endpoint. The server will return a success response even though the datastore write failed silently.
4. Trigger permission check: Issue a CheckPermission request for a resource whose permission relies on a relation using the exclusion operator and the relationships that were supposed to be written.
5. Observe incorrect result: Because the relationships were never persisted, the permission check evaluates against incomplete data, potentially returning an incorrect authorization decision (e.g., access granted when it should be denied, or vice versa) (GitHub Advisory).

• Logs: SpiceDB server logs showing no datastore error for large WriteRelationships calls despite the payload exceeding datastore limits; absence of expected relationship entries after a reported-successful write.
• Application Behavior: Permission check results that are inconsistent with expected access control policy, particularly for resources governed by exclusion-based relations.
• Monitoring: Unexpected authorization decisions (access granted or denied contrary to policy) for users or resources that should have had their permissions updated via a recent WriteRelationships call with a large batch.

Upgrade SpiceDB to version 1.45.2 or later, which contains the patch for this issue (commit d0cd103). As an immediate workaround for deployments that cannot upgrade, set --write-relationships-max-updates-per-call to 1000 to prevent oversized payloads from reaching the datastore. Additionally, review and validate permission checks in the application to ensure no incorrect authorization decisions were made during the window of exposure (GitHub Advisory, SpiceDB Advisory).