OpenFGA Authorization Bypass

OpenFGA, an authorization system, has a flaw where it incorrectly caches permission decisions when using advanced features like conditions and contextual data. An attacker could exploit this to bypass permission checks and gain unauthorized access to resources.

CVE-2024-56323 is an authorization bypass in OpenFGA v1.3.8–v1.8.2 affecting Check/ListObjects APIs when conditions and contextual tuples are used simultaneously with query caching enabled. The vulnerability stems from improper cache handling of conditional authorization logic, allowing attackers to reuse cached positive decisions for unauthorized access requests. Mitigation requires upgrading to v1.8.3 or disabling the check query cache.