Authorization Bypass

github.com/openfga/openfga is vulnerable to Authorization Bypass. The vulnerability is due to improper handling of exclusion or intersection models, leading to potential bypass when calling certain APIs...

PT-2024-24086

Name of the Vulnerable Software and Affected Versions OpenFGA versions 1.5.0 through 1.5.2 Description The issue concerns an authorization bypass when calling Check or ListObjects APIs in OpenFGA. Users are likely affected if their model involves exclusion e.g., a but not b or intersection e.g., ...