CVE-2025-46331
OpenFGA Authorization Bypass
Summary
OpenFGA Authorization Bypass
Original description
The description as published by the source.
OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.8.10 to v1.3.6 (Helm chart <= openfga-0.2.28, docker <= v.1.8.10) are vulnerable to authorization bypass when certain Check and ListObject calls are executed. This issue has been patched in version 1.8.11.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Go
github.com/openfga/openfga
[{"type":"SEMVER","events":[{"introduced":"1.3.6"},{"fixed":"1.8.11"}]}]
References
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- patch github.com