CVE-2025-64529

CVE-2025-64529 is a medium-severity vulnerability affecting SpiceDB versions prior to 1.45.2, an open-source database for managing application permissions. Specifically, it impacts configurations using the exclusion operator, a high `--write-relationships-max-updates-per-call` value, and large WriteRelationships payloads exceeding datastore limits. This can lead to incorrect permission checks due to silently failed write operations, despite a successful response. The vulnerability has a CVSS score of 6.5 (Medium), indicating a network attack vector with low attack complexity and no user interaction required. The potential impact is limited to integrity and availability, as incorrect permissions could be granted or denied. Currently, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness.