CVE-2024-42473: high-severity vulnerability in openfga
OpenFGA Authorization Bypass
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
OpenFGA versions 1.5.7 and 1.5.8 have a flaw where the Check API incorrectly evaluates permissions when using `but not` and `from` expressions with usersets, allowing unauthorized access that should be denied.
An authorization bypass vulnerability exists in OpenFGA's Check API when processing authorization models containing `but not` and `from` expressions combined with usersets. The flaw occurs during permission evaluation logic, potentially allowing access requests that should fail authorization checks. Affected versions are 1.5.7 and 1.5.8; downgrade to 1.5.6 is recommended as a mitigation.
In the same product, most dangerous first.