OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user

Description In OpenFGA, the ListUsers API could incorrectly return a user who should have been excluded. Preconditions This applies if all of the following are present: - The authorization model contains a relation defined as an intersection and where at least one operand is an exclusion of the...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the ListUsers. An attacker can gain unauthorized access to information by exploiting an intersection of relations where a user excluded by a but not clause is also granted access through another operand. Note:...

Authorization Bypass

github.com/openfga/openfga is vulnerable to Authorization Bypass. The vulnerability is due to improper handling of authorization logic with 'but not' and 'from' expressions and a userset, allowing an attacker to bypass authorization checks and gain unauthorized access to resources...

CVE-2024-42473: Incorrect Authorization

OpenFGA is an authorization/permission engine. OpenFGA v1.5.7 and v1.5.8 are vulnerable to authorization bypass when calling Check API with a model that uses but not and from expressions and a userset. Users should downgrade to v1.5.6 as soon as possible. This downgrade is backward compatible. As...

WP-Forum Cross Site Scripting / SQL Injection

Multiple Vulnerabilities in WP Forum WordPress Plugin 1. Advisory Information Title: Multiple Vulnerabilities in WP-Forum Advisory URL: http://www.charleshooper.net/advisories/ Date Published: 12/17/2010 Vendors Contacted: WordPress. Maintainer of plugin is unreachable. 2. Summary WP Forum is a...