CVE-2022-39340

OpenFGA is an authorization/permission engine. Prior to version 0.2.4, the "streamed-list-objects" endpoint was not validating the authorization header, resulting in disclosure of objects in the store. Users "openfga/openfga" versions 0.2.3 and prior who are exposing the OpenFGA service to the...

CVE-2022-39340

CVE-2022-39340 affects the OpenFGA authorization engine. Prior to version 0.2.4, the streaming endpoint streamed-list-objects did not validate the Authorization header, allowing disclosure of objects in the store. Affected: OpenFGA 0.2.3 and earlier, especially when exposed to the internet. Impac...

CVE-2022-39340 OpenFGA Information Disclosure

OpenFGA is an authorization/permission engine. Prior to version 0.2.4, the streamed-list-objects endpoint was not validating the authorization header, resulting in disclosure of objects in the store. Users openfga/openfga versions 0.2.3 and prior who are exposing the OpenFGA service to the intern...

CVE-2022-39342 OpenFGA Authorization Bypass

OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass under certain conditions. Users whose model has a relation defined as a tupleset the right hand side of a ‘from’ statement that involves anything other than a direct relationship...

CVE-2022-39341

OpenFGA (authorization engine) is affected by CVE-2022-39341. Versions prior to 0.2.4 are vulnerable to an authorization bypass when a wildcard (*) is defined on tupleset relations in the authorization model. The issue is fixed in version 0.2.4, which contains the patch. Affected product/componen...