CVE-2025-46331
OpenFGA Authorization Bypass
Résumé
OpenFGA Authorization Bypass
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Overview
OpenFGA v1.8.10 or previous (Helm chart <= openfga-0.2.28, docker <= v.1.8.10) are vulnerable to authorization bypass when certain Check and ListObject calls are executed.
Am I Affected?
If you are using OpenFGA v1.8.10 or previous, specifically under the following conditions, you are affected by this authorization bypass vulnerability:
- Calling Check API or ListObjects with an authorization model that has tuple cycle.
- Check query cache is enabled, and
- There are multiple check / list objects requests involving the tuple cycle within the check query TTL
Fix
Upgrade to v1.8.11. This upgrade is backwards compatible.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Go
github.com/openfga/openfga
[{"type":"SEMVER","events":[{"introduced":"1.3.6"},{"fixed":"1.8.11"}]}]
Références
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com