IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-01-13 22:15

MODIFIED

2025-01-13 22:15

EPSS (Prob. Exploit)

0.44%

Top 62.6%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-11 OSV 🔗 2026-11-01

> DESCRIPTION

OpenFGA is an authorization/permission engine. IN OpenFGA v1.3.8 to v1.8.2 (Helm chart openfga-0.1.38 to openfga-0.2.19, docker v1.3.8 to v.1.8.2) are vulnerable to authorization bypass under the following conditions: 1. calling Check API or ListObjects with a model that uses [conditions](https://openfga.dev/docs/modeling/conditions), and 2. calling Check API or ListObjects API with [contextual tuples](https://openfga.dev/docs/concepts#what-are-contextual-tuples) that include conditions and 3. OpenFGA is configured with caching enabled (`OPENFGA_CHECK_QUERY_CACHE_ENABLED`). Users are advised to upgrade to v1.8.3. There are no known workarounds for this vulnerability.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-32q6-rr98-cjqv MODERATE

OpenFGA Authorization Bypass

AFFECTED PACKAGES:

GO / github.com/openfga/openfga

>= 1.3.8, < 1.8.3

Fixed in: 1.8.3

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

OpenFGA Authorization Bypass

AFFECTED PACKAGES:

Unknown / Unknown

46 versions affected

ALIASES:

GHSA-32q6-rr98-cjqv, GO-2025-3384

> HISTORIQUE DES MODIFICATIONS

Première apparition

13/01/2025 22:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 14:58

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui