GHSA-vj4m-83m8-xpw5MediumCVSS 5.9

OpenFGA Authorization Bypass via tupleset wildcard

Published
October 25, 2022
Last Modified
June 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-39341 →

📋 Description

Overview

During our internal security assessment, it was discovered that OpenFGA versions v0.2.3 and prior are vulnerable to authorization bypass under certain conditions.

Am I affected?

You are affected by this vulnerability if you are using openfga/openfga version v0.2.3 and you added a tuple with a wildcard (*) assigned to a tupleset relation (the right hand side of a ‘from’ statement).

How to fix that?

Upgrade to version v0.2.4.

Backward Compatibility

This update is not backward compatible with any authorization model that uses wildcard on a tupleset relation.

🎯 Affected products1

  • go/github.com/openfga/openfga:<= 0.2.3

🔗 References (5)