CVE-2025-64751: medium-severity vulnerability in openfga
OpenFGA Improper Policy Enforcement
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
OpenFGA, an authorization engine, fails to properly enforce access policies in certain permission checks. This means an application using OpenFGA might incorrectly allow or deny user access to resources due to flawed policy evaluation logic.
OpenFGA versions 1.4.0 through 1.11.0 contain improper policy enforcement in Check and ListObject API calls, potentially allowing authorization bypass or incorrect permission decisions. The vulnerability affects Helm chart versions openfga-0.1.34 to openfga-0.2.48 and Docker images up to v.1.11.0; remediation requires upgrading to version 1.11.1 or later.
In the same product, most dangerous first.