OpenFGA Authorization Bypass

OpenFGA versions before 0.2.5 allow attackers to bypass authorization checks when wildcard (*) characters are used in certain permission configurations. This means unauthorized users could gain access to protected resources.

Authorization bypass in OpenFGA <0.2.5 occurs when tuplesets (relations defined with 'from' statements) are assigned wildcard (*) values, allowing improper privilege escalation. The vulnerability affects authorization models that utilize wildcards on tupleset relations; exploitation requires a malicious actor to craft requests that exploit the misconfigured wildcard permissions. Upgrading to v0.2.5+ resolves the issue, though models using wildcard tuplesets require reconfiguration.