OpenFGA Authorization Bypass
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.9epss 0.9%
exploitation probability
0.9%top 45% of all CVEs
observed exploitation
nono source reports it
In short
OpenFGA, an authorization engine, has a flaw that allows users to bypass permission checks in certain configurations. This happens when the permission model uses complex relationship definitions, potentially letting unauthorized users access protected resources.
Technical detail
OpenFGA versions prior to 0.2.4 contain an authorization bypass vulnerability (CWE-285) affecting models with tupleset relations involving non-direct relationships. An attacker with knowledge of the authorization model structure can craft requests that circumvent permission validation logic, bypassing intended access controls.
Summary generated and translated by AI from the official description.
OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass under certain conditions. Users whose model has a relation defined as a tupleset (the right hand side of a ‘from’ statement) that involves anything other than a direct relationship (e.g. ‘as self’) are vulnerable. Version 0.2.4 contains a patch for this issue.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
openfga · openfga