GHSA-f4mm-2r69-mg5f OpenFGA Authorization Bypass

• Go github.com/openfga/openfga: < 0.2.4 → fixed in 0.2.4

Overview During our internal security assessment, it was discovered that OpenFGA versions `v0.2.3` and prior are vulnerable to authorization bypass under certain conditions. Am I Affected? You are affected by this vulnerability if you are using `openfga/openfga` version `v0.2.3` or prior, and your model has a relation defined as a tupleset (the right hand side of a ‘from’ statement) that involves anything other than a direct relationship (e.g. ‘as self’) How to fix that? Upgrade to version `v0.2.4`. Backward Compatibility This update is not backward compatible. Any model involving rewritten tupleset relations will no longer be acceptable and has to be modified.