GHSA-3gfj-fxx4-f22w OpenFGA Authorization Bypass

• Go github.com/openfga/openfga: < 0.2.5 → fixed in 0.2.5

Overview During our internal security assessment, it was discovered that OpenFGA versions v0.2.4 and prior are vulnerable to authorization bypass under certain conditions. Am I Affected? You are affected by this vulnerability if you are using `openfga/openfga` version v0.2.4 or prior, and have tuples where the `user` field is set to a `userset` e.g. `folder:test#owner`, and the tuple's relation is used on the right-hand side of a `from` statement. How to fix that? Upgrade to version 0.2.5. Backward Compatibility This update is not backward compatible. Any tuples where the `user` field is set to a `userset`, and the tuple's relation is used on the right-hand side of a `from` statement have to be rewritten.