OpenFGA Authorization Bypass

OpenFGA, an authorization engine, has a flaw that allows users to bypass permission checks in certain configurations. This happens when the permission model uses complex relationship definitions, potentially letting unauthorized users access protected resources.

OpenFGA versions prior to 0.2.4 contain an authorization bypass vulnerability (CWE-285) affecting models with tupleset relations involving non-direct relationships. An attacker with knowledge of the authorization model structure can craft requests that circumvent permission validation logic, bypassing intended access controls.