https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T06:20:54.100336+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-236427 EUVD-2026-236427 2026-10-04T06:20:54.151064+00:00 EUVD-2026-236427 https://cve.radiocsirt.org/vuln/fkie_cve-2025-46331 fkie_cve-2025-46331 2026-10-04T06:20:54.151101+00:00

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.8.10 to v1.3.6 (Helm chart <= openfga-0.2.28, docker <= v.1.8.10) are vulnerable to authorization bypass when certain Check and ListObject calls are executed. This issue has been patched in version 1.8.11.

 https://cve.radiocsirt.org/vuln/ghsa-w222-m46c-mgh6 GHSA-w222-m46c-mgh6 — OpenFGA Authorization Bypass 2026-10-04T06:20:54.151135+00:00

Affected: Go: github.com/openfga/openfga

Overview OpenFGA v1.8.10 or previous (Helm chart <= openfga-0.2.28, docker <= v.1.8.10) are vulnerable to authorization bypass when certain Check and ListObject calls are executed.

Am I Affected? If you are using OpenFGA v1.8.10 or previous, specifically under the following conditions, you are affected by this authorization bypass vulnerability: - Calling Check API or ListObjects with an [authorization model](https://openfga.dev/docs/concepts#what-is-an-authorization-model) that has tuple cycle. - [Check query cache](https://github.com/openfga/openfga/blob/9b5974458b777707ed2a30ba6303699499e655ee/.config-schema.json#L528) is enabled, and - There are multiple check / list objects requests involving the tuple cycle within the check query TTL

Fix Upgrade to v1.8.11. This upgrade is backwards compatible.

 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15135-1 openSUSE-SU-2025:15135-1 — govulncheck-vulndb-0.0.20250515T200012-1.1 on GA media 2026-10-04T06:20:54.151166+00:00

govulncheck-vulndb-0.0.20250515T200012-1.1 on GA media