OpenFGA Authorization Bypass

OpenFGA, an authorization system, had a flaw where wildcards in permission rules could be bypassed, allowing unauthorized access. This matters because it undermines the security of applications relying on OpenFGA to protect sensitive operations.

OpenFGA versions before 0.2.4 contain an authorization bypass vulnerability affecting tupleset relations with wildcard (`*`) definitions in the authorization model. Attackers can exploit this to circumvent intended access controls without requiring special privileges or authentication bypass, leading to unauthorized access to protected resources.