CVE-2022-23542highCWE-285

CVE-2022-23542: high-severity vulnerability in openfga

OpenFGA Authorization Bypass

Published · Updated

Follow this CVE+ Monitor openfga+ Monitor github.com/openfga/openfga

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.7epss 1.0%
In short

OpenFGA versions before 0.3.1 have a flaw that allows attackers to bypass authorization checks under certain conditions, potentially gaining unauthorized access to protected resources or actions.

Technical detail

OpenFGA 0.3.0 contains an authorization bypass vulnerability (CWE-285) that permits attackers to circumvent permission enforcement mechanisms. The vulnerability requires specific preconditions to be met; exploitation results in unauthorized access to restricted functionality. The flaw was remediated in version 0.3.1 with backward compatibility maintained.

Summary generated and translated by AI from the official description.
OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. During an internal security assessment, it was discovered that OpenFGA version 0.3.0 is vulnerable to authorization bypass under certain conditions. This issue has been patched in version 0.3.1 and is backward compatible.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Affected products
openfga · openfga
Related CVEs — openfga

In the same product, most dangerous first.

CVE-2022-39341MEDIUMOpenFGA Authorization BypassEPSS 1.1%CVE-2022-39342MEDIUMOpenFGA Authorization BypassEPSS 1.1%CVE-2023-35933MEDIUMOpenFGA denial of service die to circular relationshipEPSS 1.1%CVE-2023-43645MEDIUMDenial of service from circular relationship definitions in OpenFGAEPSS 0.9%CVE-2022-39340MEDIUMOpenFGA Information DisclosureEPSS 0.9%CVE-2024-23820MEDIUMOpenFGA DoSEPSS 0.7%