CVE-2024-31452highCWE-863

CVE-2024-31452: high-severity vulnerability in openfga

OpenFGA Authorization Bypass

Published · Updated

Follow this CVE+ Monitor openfga+ Monitor github.com/openfga/openfga

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.1epss 0.7%
In short

OpenFGA versions 1.5.0 and later have a flaw that allows attackers to bypass permission checks when using exclusion or intersection rules (like 'allow A but not B'). This means unauthorized users could gain access to resources they shouldn't be able to see.

Technical detail

CVE-2024-31452 affects OpenFGA's Check and ListObjects APIs when authorization models employ exclusion or intersection operators. An unauthenticated attacker can craft requests that bypass the intended permission logic, potentially gaining unauthorized access to restricted resources. The vulnerability is resolved in v1.5.3.

Summary generated and translated by AI from the official description.
OpenFGA is a high-performance and flexible authorization/permission engine. Some end users of OpenFGA v1.5.0 or later are vulnerable to authorization bypass when calling Check or ListObjects APIs. You are very likely affected if your model involves exclusion (e.g. `a but not b`) or intersection (e.g. `a and b`). This vulnerability is fixed in v1.5.3.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
openfga · openfga
Related CVEs — openfga

In the same product, most dangerous first.

CVE-2022-39341MEDIUMOpenFGA Authorization BypassEPSS 1.1%CVE-2022-39342MEDIUMOpenFGA Authorization BypassEPSS 1.1%CVE-2023-35933MEDIUMOpenFGA denial of service die to circular relationshipEPSS 1.1%CVE-2022-23542HIGHOpenFGA Authorization BypassEPSS 1.0%CVE-2023-43645MEDIUMDenial of service from circular relationship definitions in OpenFGAEPSS 0.9%CVE-2022-39340MEDIUMOpenFGA Information DisclosureEPSS 0.9%