CVE-2025-64751 OpenFGA Improper Policy Enforcement
MediumCVSS 5.8
EPSS 0.31%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.4.0 to v1.11.0 ( openfga-0.1.34 <= Helm chart <= openfga-0.2.48, v.1.4.0 <= docker <= v.1.11.0) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed. This issue has been patched in version 1.11.1.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openfga(Go) | >= 1.4.0, < 1.11.1 | 1.11.1 |
| openfga | = >= 1.4.0, < 1.11.1 | No fix listed |
| openfga helm charts | >= 0.1.34, < 0.2.49 | 0.2.49 |
| openfga | >= 1.4.0, < 1.11.1 | 1.11.1 |
References
- https://github.com/openfga/openfga/security/advisories/GHSA-2c64-vmv2-hgfc vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com product
- https://github.com/openfga/openfga/releases/tag/v1.11.1 release-notes
- github.com