CVE-2023-40579mediumCWE-284

CVE-2023-40579: medium-severity vulnerability in openfga

OpenFGA Authorization Bypass

Published · Updated

Follow this CVE+ Monitor openfga+ Monitor github.com/openfga/openfga

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.5%
In short

OpenFGA versions 1.3.0 and earlier have a flaw in the ListObjects API that allows unauthorized access to objects in certain permission models. Attackers can bypass authorization checks when the model uses specific relationship expressions, potentially exposing data they shouldn't access.

Technical detail

The ListObjects API in OpenFGA ≤1.3.0 fails to properly enforce authorization checks when permission models contain relationship expressions of the form 'rel1 from type1'. This allows attackers to enumerate or access objects they lack permission for, bypassing intended access controls. The issue is resolved in version 1.3.1.

Summary generated and translated by AI from the official description.
OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. Some end users of OpenFGA v1.3.0 or earlier are vulnerable to authorization bypass when calling the ListObjects API. The vulnerability affects customers using `ListObjects` with specific models. The affected models contain expressions of type `rel1 from type1`. This issue has been patched in version 1.3.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
openfga · openfga
Related CVEs — openfga

In the same product, most dangerous first.

CVE-2022-39341MEDIUMOpenFGA Authorization BypassEPSS 1.1%CVE-2022-39342MEDIUMOpenFGA Authorization BypassEPSS 1.1%CVE-2023-35933MEDIUMOpenFGA denial of service die to circular relationshipEPSS 1.1%CVE-2022-23542HIGHOpenFGA Authorization BypassEPSS 1.0%CVE-2023-43645MEDIUMDenial of service from circular relationship definitions in OpenFGAEPSS 0.9%CVE-2022-39340MEDIUMOpenFGA Information DisclosureEPSS 0.9%