Most recent entries from all

EUVD-2026-261775

fkie_cve-2025-64751

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.4.0 to v1.11.0 ( openfga-0.1.34 <= Helm chart <= openfga-0.2.48, v.1.4.0 <= docker <= v.1.11.0) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed. This issue has been patched in version 1.11.1.

GHSA-2c64-vmv2-hgfc — OpenFGA Improper Policy Enforcement

Affected: Go: github.com/openfga/openfga

### Overview OpenFGA v1.4.0 to v1.11.0 (openfga-0.1.34 <= Helm chart <= openfga-0.2.48, v.1.4.0 <= docker <= v.1.11.0) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed.

### Am I Affected? You are affected by this vulnerability if you meet the following preconditions: - You are using OpenFGA v1.4.0 to v1.11.0 - The model has a a relation directly assignable by a [type bound pubic access](https://openfga.dev/docs/concepts#what-is-type-bound-public-access) with [condition](https://openfga.dev/docs/modeling/conditions) - The same relation is not assignable by a type bound public access without condition - You have a type assigned for the same relation that is a type bound public access without condition

### Fix Upgrade to v1.11.1. This upgrade is backwards compatible.

### Workaround None

openSUSE-SU-2026:20654-1 — Security update for grafana

Security update for grafana

SUSE-SU-2025:4444-1 — Security update 5.1.1.1 for Multi-Linux Manager Client Tools

Security update 5.1.1.1 for Multi-Linux Manager Client Tools