CVE-2022-39352

CVE-2022-39352 affects OpenFGA (authorization engine). Vulnerability exists in versions prior to 0.2.5 when a tuple with a wildcard (*) is assigned to a tupleset relation (the right-hand side of a from statement), enabling authorization bypass under certain conditions. The issue has been patched ...

CVE-2022-39340

OpenFGA is an authorization/permission engine. Prior to version 0.2.4, the streamed-list-objects endpoint was not validating the authorization header, resulting in disclosure of objects in the store. Users openfga/openfga versions 0.2.3 and prior who are exposing the OpenFGA service to the intern...

CVE-2022-39340

CVE-2022-39340 affects the OpenFGA authorization engine. Prior to version 0.2.4, the streaming endpoint streamed-list-objects did not validate the Authorization header, allowing disclosure of objects in the store. Affected: OpenFGA 0.2.3 and earlier, especially when exposed to the internet. Impac...