CVE-2022-39340

OpenFGA is an authorization/permission engine. Prior to version 0.2.4, the "streamed-list-objects" endpoint was not validating the authorization header, resulting in disclosure of objects in the store. Users "openfga/openfga" versions 0.2.3 and prior who are exposing the OpenFGA service to the...

CVE-2022-39341

OpenFGA (authorization engine) is affected by CVE-2022-39341. Versions prior to 0.2.4 are vulnerable to an authorization bypass when a wildcard (*) is defined on tupleset relations in the authorization model. The issue is fixed in version 0.2.4, which contains the patch. Affected product/componen...

PT-2022-24910 · Openfga · Openfga

Name of the Vulnerable Software and Affected Versions: openfga/openfga versions 0.2.3 and prior Description: OpenFGA is an authorization/permission engine. The streamed-list-objects endpoint was not validating the authorization header, resulting in disclosure of objects in the store. Users who ar...

CVE-2022-39340: Improper Authorization

OpenFGA is an authorization/permission engine. Prior to version 0.2.4, the streamed-list-objects endpoint was not validating the authorization header, resulting in disclosure of objects in the store. Users openfga/openfga versions 0.2.3 and prior who are exposing the OpenFGA service to the intern...

CVE-2022-39341 OpenFGA Authorization Bypass

OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass under certain conditions. Users who have wildcard defined on tupleset relations in their authorization model are vulnerable. Version 0.2.4 contains a patch for this issue...