https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T08:45:39.252628+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-250119 EUVD-2026-250119 2026-10-07T08:45:39.298577+00:00 EUVD-2026-250119 https://cve.radiocsirt.org/vuln/fkie_cve-2025-55213 fkie_cve-2025-55213 2026-10-07T08:45:39.298616+00:00

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.9.3 to v1.9.4 ( openfga-0.2.40 <= Helm chart <= openfga-0.2.41, v1.9.3 <= docker <= v.1.9.4) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed. This vulnerability is fixed in 1.9.5.

 https://cve.radiocsirt.org/vuln/ghsa-mgh9-4mwp-fg55 GHSA-mgh9-4mwp-fg55 — OpenFGA Authorization Bypass 2026-10-07T08:45:39.298651+00:00

Affected: Go: github.com/openfga/openfga

### Overview OpenFGA v1.9.3 to v1.9.4 ( openfga-0.2.40 <= Helm chart <= openfga-0.2.41, v1.9.3 <= docker <= v.1.9.4) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed.

### Am I Affected? You are affected by this vulnerability if you are using OpenFGA v1.9.3 to v1.9.4, specifically under the following preconditions: - Calling Check API or ListObjects with an [authorization model](https://openfga.dev/docs/concepts#what-is-an-authorization-model) that has a relationship directly assignable by more than 1 [userset](https://openfga.dev/docs/modeling/building-blocks/usersets) with same [type](https://openfga.dev/docs/concepts#what-is-a-type), and - There are check or list object queries that rely on the above relationship, and - You have userset tuples that are assigned to the above relationship

### Fix Upgrade to v1.9.5. This upgrade is backwards compatible.

### Workaround Downgrade to v1.9.2 with enable-check-optimizations removed from OPENFGA_EXPERIMENTALS

### Acknowledgments OpenFGA would like Dominic Harries and rrozza-apolitical to thank for discovering this vulnerability.