GitHub Advisoryadvisory · Go

GHSA-3f6g-m4hr-59h8 OpenFGA Authorization Bypass

HIGH Published 2024-08-09 Modified 2024-08-14 Official page ↗
Aliases
CVE-2024-42473
Ecosystem
Go
Packages
github.com/openfga/openfga
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-285, CWE-863
Reviewed
2024-08-09

Affected packages

• Go github.com/openfga/openfga: >= 1.5.7, < 1.5.9 → fixed in 1.5.9

Description

Overview OpenFGA v1.5.7 and v1.5.8 are vulnerable to authorization bypass when calling Check API with a model that uses `but not` and `from` expressions and a userset. Fix • If you are using OpenFGA within Docker or as a Go library, as a binary, or through Docker, upgrade to v1.5.9 as soon as possible • If using Helm chart, upgrade to 0.2.12 as soon as possible. This fix is backward compatible.

Related

Alias · CVE (1)

  • CVE-2024-42473 OpenFGA is an authorization/permission engine. vulnerability

Weakness · CWE (2)

  • CWE-285 Improper Authorization weakness
  • CWE-863 Incorrect Authorization weakness

References