CVE-2025-46331: medium-severity vulnerability in openfga
OpenFGA Authorization Bypass
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
OpenFGA versions 1.3.6 to 1.8.10 have a flaw that allows attackers to bypass authorization checks through specially crafted Check and ListObject requests, potentially gaining unauthorized access to protected resources.
OpenFGA versions 1.3.6 through 1.8.10 contain an authorization bypass vulnerability in the Check and ListObject API endpoints (CWE-284). Attackers can exploit this flaw by sending specially crafted requests to circumvent permission validation, allowing unauthorized access to resources without proper authorization evaluation. The vulnerability affects Helm chart versions up to 0.2.28 and Docker images up to v1.8.10.
In the same product, most dangerous first.