GO-2026-6488 OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user in github.com/openfga/openfga

OpenFGA: ListUsers returns a deliberately-excluded user when a but not exclusion under a type-bound wildcard is intersected and with another relation that also grants that user in github.com/openfga/openfga...

GO-2022-1080 OpenFGA Authorization Bypass via tupleset wildcard in github.com/openfga/openfga

OpenFGA Authorization Bypass via tupleset wildcard in github.com/openfga/openfga...

GO-2022-1081 OpenFGA Authorization Bypass in github.com/openfga/openfga

OpenFGA Authorization Bypass in github.com/openfga/openfga...

Authorization Bypass

github.com/openfga/openfga is vulnerable to Authorization Bypass. The vulnerability is due to improper handling of authorization logic with 'but not' and 'from' expressions and a userset, allowing an attacker to bypass authorization checks and gain unauthorized access to resources...

GO-2024-2729 OpenFGA Authorization Bypass in github.com/openfga/openfga

OpenFGA Authorization Bypass in github.com/openfga/openfga...

Authorization Bypass

github.com/openfga/openfga is vulnerable to authorization bypass. The vulnerability exists in the readUserTuple function in checkutils.go due to the lack of validation in authorization mechanism which allows an attacker to bypass the authorization mechanism under certain conditions...