Detections
Analytics
SCA: security update for github.com/authzed/spicedb (GHSA-pm3x-jrhh-qcr7)
medium Tenable Cloud Security Plugin ID 436043
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- SpiceDB is an open source database system for creating and managing security-critical application
permissions. In versions prior to 1.45.2, users who use the exclusion operator somewhere in their
authorization schema; have configured their SpiceDB server such that `--write-relationships-max-updates-
per-call` is bigger than 6500; and issue calls to WriteRelationships with a large enough number of updates
that cause the payload to be bigger than what their datastore allows; will receive a successful response
from their `WriteRelationships` call, when in reality that call failed, and receive incorrect permission
check results, if those relationships had to be read to resolve the relation involving the exclusion.
Version 1.45.2 contains a patch for the issue. As a workaround, set `--write-relationships-max-updates-
per-call` to `1000`. (CVE-2025-64529)
See Also
Plugin Details
Severity: Medium
ID: 436043
Version: Revision 1.9
Type: Local
Family: SCA Checks
Published: 11/14/2025
Updated: 6/1/2026
Risk Information
VPR
Risk Factor: Low
Score: 2.5
Vendor
Vendor Severity: Low
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Temporal Score: 4.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P
CVSS Score Source: CVE-2025-64529
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Medium
Base Score: 6.9
Threat Score: 2.7
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 11/13/2025
Vulnerability Publication Date: 11/10/2025
Reference Information
CVE: CVE-2025-64529
cwe: CWE-770