OpenFGA 安全漏洞

OpenFGA is OpenFGA's high performance and flexible authorization/licensing engine built for developers and inspired by Google Zanzibar. A security vulnerability exists in versions of OpenFGA prior to 0.2.4, which stems from the ease of bypassing authorization under certain circumstances...

CVE-2022-39342: Improper Authorization

OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass under certain conditions. Users whose model has a relation defined as a tupleset the right hand side of a ‘from’ statement that involves anything other than a direct relationship...

CVE-2022-39340 OpenFGA Information Disclosure

OpenFGA is an authorization/permission engine. Prior to version 0.2.4, the streamed-list-objects endpoint was not validating the authorization header, resulting in disclosure of objects in the store. Users openfga/openfga versions 0.2.3 and prior who are exposing the OpenFGA service to the intern...

CVE-2022-39341

OpenFGA (authorization engine) is affected by CVE-2022-39341. Versions prior to 0.2.4 are vulnerable to an authorization bypass when a wildcard (*) is defined on tupleset relations in the authorization model. The issue is fixed in version 0.2.4, which contains the patch. Affected product/componen...