CVE-2022-39340: medium-severity vulnerability in openfga
OpenFGA Information Disclosure
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.9%
In short
OpenFGA's streamed-list-objects endpoint failed to validate authorization headers, allowing attackers to view objects stored in the system without proper permission. This affects versions 0.2.3 and earlier when exposed to the internet.
Technical detail
The streamed-list-objects endpoint in OpenFGA versions ≤0.2.3 does not enforce authorization header validation, enabling unauthorized information disclosure of stored objects. The vulnerability requires network access to the exposed endpoint; patched in version 0.2.4.
Summary generated and translated by AI from the official description.
OpenFGA is an authorization/permission engine. Prior to version 0.2.4, the `streamed-list-objects` endpoint was not validating the authorization header, resulting in disclosure of objects in the store. Users `openfga/openfga` versions 0.2.3 and prior who are exposing the OpenFGA service to the internet are vulnerable. Version 0.2.4 contains a patch for this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
openfga · openfgaRelated CVEs — openfga
In the same product, most dangerous first.
CVE-2022-39341MEDIUMOpenFGA Authorization BypassEPSS 1.1%CVE-2022-39342MEDIUMOpenFGA Authorization BypassEPSS 1.1%CVE-2023-35933MEDIUMOpenFGA denial of service die to circular relationshipEPSS 1.1%CVE-2022-23542HIGHOpenFGA Authorization BypassEPSS 1.0%CVE-2023-43645MEDIUMDenial of service from circular relationship definitions in OpenFGAEPSS 0.9%CVE-2024-23820MEDIUMOpenFGA DoSEPSS 0.7%