GHSA-f4mm-2r69-mg5f
OpenFGA Authorization Bypass
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/openfga/openfga | < 0.2.4 | 0.2.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Overview
During our internal security assessment, it was discovered that OpenFGA versions `v0.2.3` and prior are vulnerable to authorization bypass under certain conditions.
### Am I Affected?
You are affected by this vulnerability if you are using `openfga/openfga` version `v0.2.3` or prior, and your model has a relation defined as a tupleset (the right hand side of a ‘from’ statement) that involves anything other than a direct relationship (e.g. ‘as self’)
### How to fix that?
Upgrade to version `v0.2.4`.
### Backward Compatibility
This update is not backward compatible.
Any model involving rewritten tupleset relations will no longer be acceptable and has to be modified.
References
External links from the advisory. They lead to third-party sites.