CVEvulnerability

CVE-2023-40579

6.5 MEDIUM Published 2023-08-25 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-08-25
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-284

Description

OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. Some end users of OpenFGA v1.3.0 or earlier are vulnerable to authorization bypass when calling the ListObjects API. The vulnerability affects customers using `ListObjects` with specific models. The affected models contain expressions of type `rel1 from type1`. This issue has been patched in version 1.3.1.

Affected configurations

• openfga openfga (< 1.3.1)

Related

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References