CVE-2022-39342: medium-severity vulnerability in openfga
OpenFGA Authorization Bypass
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
OpenFGA, an authorization engine, has a flaw that allows users to bypass permission checks in certain configurations. This happens when the permission model uses complex relationship definitions, potentially letting unauthorized users access protected resources.
OpenFGA versions prior to 0.2.4 contain an authorization bypass vulnerability (CWE-285) affecting models with tupleset relations involving non-direct relationships. An attacker with knowledge of the authorization model structure can craft requests that circumvent permission validation logic, bypassing intended access controls.
In the same product, most dangerous first.