GitHub Advisoryadvisory · Go

GHSA-8cph-m685-6v6r OpenFGA Authorization Bypass

HIGH Published 2024-04-16 Modified 2024-04-17 Official page ↗
Aliases
CVE-2024-31452
Ecosystem
Go
Packages
github.com/openfga/openfga
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-285, CWE-863
Reviewed
2024-04-16

Affected packages

• Go github.com/openfga/openfga: >= 1.5.0, < 1.5.3 → fixed in 1.5.3

Description

Overview Some end users of OpenFGA v1.5.0 or later are vulnerable to authorization bypass when calling Check or ListObjects APIs. Am I Affected? You are very likely affected if your model involves exclusion (e.g. `a but not b`) or intersection (e.g. `a and b`) and you have any cyclical relationships. If you are using these, please update as soon as possible. Fix Update to v1.5.3 Backward Compatibility This update is backward compatible.

Related

Alias · CVE (1)

  • CVE-2024-31452 OpenFGA is a high-performance and flexible authorization/permission engine. vulnerability

Weakness · CWE (2)

  • CWE-285 Improper Authorization weakness
  • CWE-863 Incorrect Authorization weakness

References