CVE-2025-46331
OpenFGA Authorization Bypass
Résumé
OpenFGA Authorization Bypass
Description d'origine
La description telle que publiée par la source (souvent en anglais).
OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.8.10 to v1.3.6 (Helm chart <= openfga-0.2.28, docker <= v.1.8.10) are vulnerable to authorization bypass when certain Check and ListObject calls are executed. This issue has been patched in version 1.8.11.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Go
github.com/openfga/openfga
[{"type":"SEMVER","events":[{"introduced":"1.3.6"},{"fixed":"1.8.11"}]}]
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- patch github.com