CVE-2022-39341: medium-severity vulnerability in openfga
OpenFGA Authorization Bypass
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
OpenFGA, an authorization system, had a flaw where wildcards in permission rules could be bypassed, allowing unauthorized access. This matters because it undermines the security of applications relying on OpenFGA to protect sensitive operations.
OpenFGA versions before 0.2.4 contain an authorization bypass vulnerability affecting tupleset relations with wildcard (`*`) definitions in the authorization model. Attackers can exploit this to circumvent intended access controls without requiring special privileges or authentication bypass, leading to unauthorized access to protected resources.
In the same product, most dangerous first.