https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 07:03:06 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-241174 EUVD-2026-241174 https://cve.radiocsirt.org/vuln/euvd-2026-241174 https://cve.radiocsirt.org/vuln/fkie_cve-2025-48371 <p>OpenFGA is an authorization/permission engine. OpenFGA versions 1.8.0 through 1.8.12 (corresponding to Helm chart openfga-0.2.16 through openfga-0.2.30 and docker 1.8.0 through 1.8.12) are vulnerable to authorization bypass when certain Check and ListObject calls are executed. Users are affected under four specific conditions: First, calling Check API or ListObjects with an authorization model that has a relationship directly assignable by both type bound public access and userset; second, there are check or list object queries with contextual tuples for the relationship that can be directly assignable by both type bound public access and userset; third, those contextual tuples’s user field is an userset; and finally, type bound public access tuples are not assigned to the relationship. Users should upgrade to version 1.8.13 to receive a patch. The upgrade is backwards compatible.</p> <p>OpenFGA is an authorization/permission engine. OpenFGA versions 1.8.0 through 1.8.12 (corresponding to Helm chart openfga-0.2.16 through openfga-0.2.30 and docker 1.8.0 through 1.8.12) are vulnerable to authorization bypass when certain Check and ListObject calls are executed. Users are affected under four specific conditions: First, calling Check API or ListObjects with an authorization model that has a relationship directly assignable by both type bound public access and userset; second, there are check or list object queries with contextual tuples for the relationship that can be directly assignable by both type bound public access and userset; third, those contextual tuples’s user field is an userset; and finally, type bound public access tuples are not assigned to the relationship. Users should upgrade to version 1.8.13 to receive a patch. The upgrade is backwards compatible.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-48371 https://cve.radiocsirt.org/vuln/ghsa-c72g-53hw-82q7 <p><strong>Affected:</strong> Go: github.com/openfga/openfga</p> <p>### Overview OpenFGA v1.8.0 to v1.8.12 ( openfga-0.2.16 &lt;= Helm chart &lt;= openfga-0.2.31, v1.8.0 &lt;= docker &lt;= v.1.8.12) are vulnerable to authorization bypass when certain Check and ListObject calls are executed.</p> <p>### Am I Affected? If you are using OpenFGA v1.8.0 to v1.8.12, specifically under the following conditions, you are affected by this authorization bypass vulnerability: - Calling Check API or ListObjects with an [authorization model](https://openfga.dev/docs/concepts#what-is-an-authorization-model) that has a relationship directly assignable by both [type bound public access](https://openfga.dev/docs/concepts#what-is-type-bound-public-access) and [userset](https://openfga.dev/docs/modeling/building-blocks/usersets), and - There are check or list object queries with [contextual tuples](https://openfga.dev/docs/interacting/contextual-tuples) for the relationship that can be directly assignable by both [type bound public access](https://openfga.dev/docs/concepts#what-is-type-bound-public-access) and [userset](https://openfga.dev/docs/modeling/building-blocks/usersets), and - Those contextual tuples’s user field is an userset, and - Type bound public access tuples are not assigned to the relationship</p> <p>### Fix Upgrade to v1.8.13. This upgrade is backwards compatible.</p> <p>### Acknowledgments OpenFGA would like to thank @udyvish for discovering this vulnerability.</p> <p><strong>Affected:</strong> Go: github.com/openfga/openfga</p> <p>### Overview OpenFGA v1.8.0 to v1.8.12 ( openfga-0.2.16 &lt;= Helm chart &lt;= openfga-0.2.31, v1.8.0 &lt;= docker &lt;= v.1.8.12) are vulnerable to authorization bypass when certain Check and ListObject calls are executed.</p> <p>### Am I Affected? If you are using OpenFGA v1.8.0 to v1.8.12, specifically under the following conditions, you are affected by this authorization bypass vulnerability: - Calling Check API or ListObjects with an [authorization model](https://openfga.dev/docs/concepts#what-is-an-authorization-model) that has a relationship directly assignable by both [type bound public access](https://openfga.dev/docs/concepts#what-is-type-bound-public-access) and [userset](https://openfga.dev/docs/modeling/building-blocks/usersets), and - There are check or list object queries with [contextual tuples](https://openfga.dev/docs/interacting/contextual-tuples) for the relationship that can be directly assignable by both [type bound public access](https://openfga.dev/docs/concepts#what-is-type-bound-public-access) and [userset](https://openfga.dev/docs/modeling/building-blocks/usersets), and - Those contextual tuples’s user field is an userset, and - Type bound public access tuples are not assigned to the relationship</p> <p>### Fix Upgrade to v1.8.13. This upgrade is backwards compatible.</p> <p>### Acknowledgments OpenFGA would like to thank @udyvish for discovering this vulnerability.</p> https://cve.radiocsirt.org/vuln/ghsa-c72g-53hw-82q7 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15179-1 <p>govulncheck-vulndb-0.0.20250527T204717-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20250527T204717-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15179-1