~ / search / GHSA-8cph-m685-6v6r

GHSA-8cph-m685-6v6r

OpenFGA Authorization Bypass

Source: GitHub Advisory Database (reviewed) High CVE-2024-31452

Packages

EcosystemPackageAffectedFixed in
Go github.com/openfga/openfga >= 1.5.0, < 1.5.3 1.5.3

Details

As written in the advisory (Markdown source, shown as plain text).

# Overview Some end users of OpenFGA v1.5.0 or later are vulnerable to authorization bypass when calling Check or ListObjects APIs. # Am I Affected? You are very likely affected if your model involves exclusion (e.g. `a but not b`) or intersection (e.g. `a and b`) and you have any cyclical relationships. If you are using these, please update as soon as possible. # Fix Update to v1.5.3 # Backward Compatibility This update is backward compatible.

References

External links from the advisory. They lead to third-party sites.