Most recent entries from all

EUVD-2026-233473

2026-10-17T07:48:18.113007+00:00

EUVD-2026-233473

fkie_cve-2022-39340

2026-10-17T07:48:18.113043+00:00

OpenFGA is an authorization/permission engine. Prior to version 0.2.4, the `streamed-list-objects` endpoint was not validating the authorization header, resulting in disclosure of objects in the store. Users `openfga/openfga` versions 0.2.3 and prior who are exposing the OpenFGA service to the internet are vulnerable. Version 0.2.4 contains a patch for this issue.

GHSA-95x7-mh78-7w2r — OpenFGA subject to Information Disclosure via streamed-list-objects endpoint

2026-10-17T07:48:18.113075+00:00

Affected: Go: github.com/openfga/openfga

### Overview During our internal security assessment, it was discovered that `streamed-list-objects` endpoint was not validating the authorization header resulting in the disclosure of objects in the store.

### Am I Affected? You are affected by this vulnerability if you are using `openfga/openfga` version `v0.2.3` or prior and you are exposing the OpenFGA service to the internet.

### How to fix that? Upgrade to version `v0.2.4`.

### Backward Compatibility This update is backward compatible.

gsd-2022-39340

2026-10-17T07:48:18.113103+00:00

gsd-2022-39340