GitHub Advisoryadvisory · Go

GHSA-jwvj-g8pc-cx45 OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision

MEDIUM Published 2026-04-07 Modified 2026-04-07 Official page ↗
Aliases
CVE-2026-34972
Ecosystem
Go
Packages
github.com/openfga/openfga
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-863
Reviewed
2026-04-07

Affected packages

• Go github.com/openfga/openfga: >= 1.8.0, < 1.14.0 → fixed in 1.14.0

Description

Description In OpenFGA, under specific conditions, BatchCheck calls with multiple checks sent for the same object, relation, and user combination can result in improper policy enforcement. Am I affected? You are affected if you meet the following preconditions: 1. You execute BatchCheck operations which rely on context. 2. Multiple checks are sent within a single BatchCheck operation for the same user/object/relation combination, each containing context. 3. The contexts between those checks differ in a specific way Fix Upgrade to OpenFGA v1.14.0 Acknowledgement OpenFGA would like to thank @bugbunny-research for the discovery and detailed report.

Related

Alias · CVE (1)

  • CVE-2026-34972 OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References