CVE-2022-39342 OpenFGA Authorization Bypass

OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass under certain conditions. Users whose model has a relation defined as a tupleset the right hand side of a ‘from’ statement that involves anything other than a direct relationship...

CVE-2022-39341 OpenFGA Authorization Bypass

OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass under certain conditions. Users who have wildcard defined on tupleset relations in their authorization model are vulnerable. Version 0.2.4 contains a patch for this issue...

CVE-2022-39340

CVE-2022-39340 affects the OpenFGA authorization engine. Prior to version 0.2.4, the streaming endpoint streamed-list-objects did not validate the Authorization header, allowing disclosure of objects in the store. Affected: OpenFGA 0.2.3 and earlier, especially when exposed to the internet. Impac...

CVE-2022-39341

OpenFGA (authorization engine) is affected by CVE-2022-39341. Versions prior to 0.2.4 are vulnerable to an authorization bypass when a wildcard (*) is defined on tupleset relations in the authorization model. The issue is fixed in version 0.2.4, which contains the patch. Affected product/componen...

CVE-2022-39342

OpenFGA versions prior to 0.2.4 are vulnerable to an authorization bypass when a model defines a relation as a tupleset that involves anything other than a direct relationship (e.g., not just as self). Version 0.2.4 patches this issue. No exploitation details are provided in the sources. Remediat...

CVE-2022-39340 OpenFGA Information Disclosure

OpenFGA is an authorization/permission engine. Prior to version 0.2.4, the streamed-list-objects endpoint was not validating the authorization header, resulting in disclosure of objects in the store. Users openfga/openfga versions 0.2.3 and prior who are exposing the OpenFGA service to the intern...