GitHub Advisoryadvisory · Go

GHSA-2c64-vmv2-hgfc OpenFGA Improper Policy Enforcement

MEDIUM Published 2025-11-20 Modified 2025-11-27 Official page ↗
Aliases
CVE-2025-64751
Ecosystem
Go
Packages
github.com/openfga/openfga
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
Weaknesses
CWE-285
Reviewed
2025-11-20

Affected packages

• Go github.com/openfga/openfga: >= 1.4.0, < 1.11.1 → fixed in 1.11.1

Description

Overview OpenFGA v1.4.0 to v1.11.0 (openfga-0.1.34 <= Helm chart <= openfga-0.2.48, v.1.4.0 <= docker <= v.1.11.0) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed. Am I Affected? You are affected by this vulnerability if you meet the following preconditions: • You are using OpenFGA v1.4.0 to v1.11.0 • The model has a a relation directly assignable by a type bound pubic access with condition • The same relation is not assignable by a type bound public access without condition • You have a type assigned for the same relation that is a type bound public access without condition Fix Upgrade to v1.11.1. This upgrade is backwards compatible. Workaround None

Related

Alias · CVE (1)

  • CVE-2025-64751 OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. vulnerability

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References