PT-2022-24912 · Openfga · Openfga

Name of the Vulnerable Software and Affected Versions: OpenFGA versions prior to 0.2.4 Description: OpenFGA is an authorization/permission engine. The issue concerns authorization bypass under certain conditions, specifically when a relation is defined as a tupleset involving anything other than ...

CVE-2022-39340 OpenFGA Information Disclosure

OpenFGA is an authorization/permission engine. Prior to version 0.2.4, the streamed-list-objects endpoint was not validating the authorization header, resulting in disclosure of objects in the store. Users openfga/openfga versions 0.2.3 and prior who are exposing the OpenFGA service to the intern...

CVE-2022-39341

OpenFGA (authorization engine) is affected by CVE-2022-39341. Versions prior to 0.2.4 are vulnerable to an authorization bypass when a wildcard (*) is defined on tupleset relations in the authorization model. The issue is fixed in version 0.2.4, which contains the patch. Affected product/componen...

OpenFGA 安全漏洞

OpenFGA is OpenFGA's high performance and flexible authorization/licensing engine built for developers and inspired by Google Zanzibar. A security vulnerability exists in versions of OpenFGA prior to 0.2.4, which stems from the ease of bypassing authorization under certain circumstances...