CVE-2025-55213

OpenFGA is affected by an Authorization Bypass vulnerability in which improper policy enforcement occurs during certain Check and ListObject calls. Affected versions are OpenFGA v1.9.3 to v1.9.4 (including openfga-0.2.40 to 0.2.41 and docker/v1.9.4). The issue is fixed in v1.9.5. Impact is descri...

CVE-2025-55213 OpenFGA Authorization Bypass (Check)

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.9.3 to v1.9.4 openfga-0.2.40 = Helm chart = openfga-0.2.41, v1.9.3 = docker = v.1.9.4 are vulnerable to improper policy enforcement when certain Check and...

CVE-2025-55213 OpenFGA Authorization Bypass (Check)

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.9.3 to v1.9.4 openfga-0.2.40 = Helm chart = openfga-0.2.41, v1.9.3 = docker = v.1.9.4 are vulnerable to improper policy enforcement when certain Check and...

OpenFGA 安全漏洞

OpenFGA is OpenFGA open source a high performance and flexible authorization/licensing engine built for developers and inspired by Google Zanzibar. A security vulnerability exists in OpenFGA versions v1.9.3 through v1.9.4 that stems from improper policy enforcement and could lead to authorization...

PT-2025-33691 · Openfga · Openfga

Name of the Vulnerable Software and Affected Versions: OpenFGA versions 1.9.3 through 1.9.4 Description: OpenFGA is an authorization/permission engine. Versions 1.9.3 through 1.9.4 are susceptible to improper policy enforcement during specific Check and ListObject calls. Recommendations: Upgrade ...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: fq, hello-world-golang, kpt, victoriametrics-cluster, sbom-convert, rke2-cloud-provider, guac, trino, ytt, hydra, prometheus-operator, rook, verticadb-operator, docker-cli-buildx, runc, podman, git-credential-oauth, otel-cli, influx, go-md2man, containerd,...

SUSE CVE-2025-48371

OpenFGA is an authorization/permission engine. OpenFGA versions 1.8.0 through 1.8.12 corresponding to Helm chart openfga-0.2.16 through openfga-0.2.30 and docker 1.8.0 through 1.8.12 are vulnerable to authorization bypass when certain Check and ListObject calls are executed. Users are affected...

GO-2025-3707 OpenFGA Authorization Bypass in github.com/openfga/openfga

OpenFGA Authorization Bypass in github.com/openfga/openfga...

Authorization Bypass

github.com/openfga/openfga is vulnerable to authorization bypass. The vulnerability is due to incorrect permission evaluation when usersets and type-bound public access overlap without proper tuple assignments, allowing attackers unauthorized resource access or actions...

CVE-2025-48371

OpenFGA is an authorization/permission engine. OpenFGA versions 1.8.0 through 1.8.12 corresponding to Helm chart openfga-0.2.16 through openfga-0.2.30 and docker 1.8.0 through 1.8.12 are vulnerable to authorization bypass when certain Check and ListObject calls are executed. Users are affected...

OpenFGA Authorization Bypass

Overview OpenFGA v1.8.0 to v1.8.12 openfga-0.2.16 = Helm chart = openfga-0.2.31, v1.8.0 = docker = v.1.8.12 are vulnerable to authorization bypass when certain Check and ListObject calls are executed. Am I Affected? If you are using OpenFGA v1.8.0 to v1.8.12, specifically under the following...

GHSA-C72G-53HW-82Q7 OpenFGA Authorization Bypass

Overview OpenFGA v1.8.0 to v1.8.12 openfga-0.2.16 = Helm chart = openfga-0.2.31, v1.8.0 = docker = v.1.8.12 are vulnerable to authorization bypass when certain Check and ListObject calls are executed. Am I Affected? If you are using OpenFGA v1.8.0 to v1.8.12, specifically under the following...

CVE-2024-23820

OpenFGA, an authorization/permission engine, is vulnerable to a denial of service attack in versions prior to 1.4.3. In some scenarios that depend on the model and tuples used, a call to ListObjects may not release memory properly. So when a sufficiently high number of those calls are executed, t...

CVE-2024-56323

OpenFGA is an authorization/permission engine. IN OpenFGA v1.3.8 to v1.8.2 Helm chart openfga-0.1.38 to openfga-0.2.19, docker v1.3.8 to v.1.8.2 are vulnerable to authorization bypass under the following conditions: 1. calling Check API or ListObjects with a model that uses conditions, and 2...

CVE-2022-39342

OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass under certain conditions. Users whose model has a relation defined as a tupleset the right hand side of a ‘from’ statement that involves anything other than a direct relationship...

CVE-2022-39341

OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass under certain conditions. Users who have wildcard defined on tupleset relations in their authorization model are vulnerable. Version 0.2.4 contains a patch for this issue...

CVE-2025-48371

OpenFGA is an authorization/permission engine. OpenFGA versions 1.8.0 through 1.8.12 corresponding to Helm chart openfga-0.2.16 through openfga-0.2.30 and docker 1.8.0 through 1.8.12 are vulnerable to authorization bypass when certain Check and ListObject calls are executed. Users are affected...

CVE-2025-48371 OpenFGA Authorization Bypass

OpenFGA is an authorization/permission engine. OpenFGA versions 1.8.0 through 1.8.12 corresponding to Helm chart openfga-0.2.16 through openfga-0.2.30 and docker 1.8.0 through 1.8.12 are vulnerable to authorization bypass when certain Check and ListObject calls are executed. Users are affected...

CVE-2025-48371

OpenFGA Open Authorization bypass (CVE-2025-48371) affects versions 1.8.0–1.8.12 of OpenFGA (and corresponding Helm/dockers) where certain Check and ListObjects calls can bypass access controls under specific conditions involving relationships that can be publicly assigned and usersets, contextua...

CVE-2025-48371 OpenFGA Authorization Bypass

OpenFGA is an authorization/permission engine. OpenFGA versions 1.8.0 through 1.8.12 corresponding to Helm chart openfga-0.2.16 through openfga-0.2.30 and docker 1.8.0 through 1.8.12 are vulnerable to authorization bypass when certain Check and ListObject calls are executed. Users are affected...