Most recent entries from all

EUVD-2026-241174

2026-10-05T07:03:27.844659+00:00

EUVD-2026-241174

fkie_cve-2025-48371

2026-10-05T07:03:27.844699+00:00

OpenFGA is an authorization/permission engine. OpenFGA versions 1.8.0 through 1.8.12 (corresponding to Helm chart openfga-0.2.16 through openfga-0.2.30 and docker 1.8.0 through 1.8.12) are vulnerable to authorization bypass when certain Check and ListObject calls are executed. Users are affected under four specific conditions: First, calling Check API or ListObjects with an authorization model that has a relationship directly assignable by both type bound public access and userset; second, there are check or list object queries with contextual tuples for the relationship that can be directly assignable by both type bound public access and userset; third, those contextual tuples’s user field is an userset; and finally, type bound public access tuples are not assigned to the relationship. Users should upgrade to version 1.8.13 to receive a patch. The upgrade is backwards compatible.

GHSA-c72g-53hw-82q7 — OpenFGA Authorization Bypass

2026-10-05T07:03:27.844757+00:00

Affected: Go: github.com/openfga/openfga

### Overview OpenFGA v1.8.0 to v1.8.12 ( openfga-0.2.16 <= Helm chart <= openfga-0.2.31, v1.8.0 <= docker <= v.1.8.12) are vulnerable to authorization bypass when certain Check and ListObject calls are executed.

### Am I Affected? If you are using OpenFGA v1.8.0 to v1.8.12, specifically under the following conditions, you are affected by this authorization bypass vulnerability: - Calling Check API or ListObjects with an [authorization model](https://openfga.dev/docs/concepts#what-is-an-authorization-model) that has a relationship directly assignable by both [type bound public access](https://openfga.dev/docs/concepts#what-is-type-bound-public-access) and [userset](https://openfga.dev/docs/modeling/building-blocks/usersets), and - There are check or list object queries with [contextual tuples](https://openfga.dev/docs/interacting/contextual-tuples) for the relationship that can be directly assignable by both [type bound public access](https://openfga.dev/docs/concepts#what-is-type-bound-public-access) and [userset](https://openfga.dev/docs/modeling/building-blocks/usersets), and - Those contextual tuples’s user field is an userset, and - Type bound public access tuples are not assigned to the relationship

### Fix Upgrade to v1.8.13. This upgrade is backwards compatible.

### Acknowledgments OpenFGA would like to thank @udyvish for discovering this vulnerability.

openSUSE-SU-2025:15179-1 — govulncheck-vulndb-0.0.20250527T204717-1.1 on GA media

2026-10-05T07:03:27.844816+00:00

govulncheck-vulndb-0.0.20250527T204717-1.1 on GA media