CVE-2025-46331 OpenFGA Authorization Bypass
MediumCVSS 5.8
EPSS 0.40%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.8.10 to v1.3.6 (Helm chart <= openfga-0.2.28, docker <= v.1.8.10) are vulnerable to authorization bypass when certain Check and ListObject calls are executed. This issue has been patched in version 1.8.11.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openfga(Go) | >= 1.3.6, < 1.8.11 | 1.8.11 |
| openfga | = >=1.3.6, <1.8.11 | No fix listed |
| openfga helm charts | >= 0.1.36, < 0.2.29 | 0.2.29 |
| openfga | >= 1.3.6, < 1.8.11 | 1.8.11 |
References
- https://github.com/openfga/openfga/security/advisories/GHSA-w222-m46c-mgh6 vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- https://github.com/openfga/openfga/commit/244302e7a8b979d66cc1874a3899cdff7d47862f patch
- github.com product
- github.com