GHSA-3gfj-fxx4-f22wMediumCVSS 4.8

OpenFGA Authorization Bypass

Published
November 8, 2022
Last Modified
April 14, 2023

🔗 CVE IDs covered (1)

CVE-2022-39352 →

📋 Description

Overview

During our internal security assessment, it was discovered that OpenFGA versions v0.2.4 and prior are vulnerable to authorization bypass under certain conditions.

Am I Affected?

You are affected by this vulnerability if you are using openfga/openfga version v0.2.4 or prior, and have tuples where the user field is set to a userset e.g. folder:test#owner, and the tuple's relation is used on the right-hand side of a from statement.

How to fix that?

Upgrade to version 0.2.5.

Backward Compatibility

This update is not backward compatible. Any tuples where the user field is set to a userset, and the tuple's relation is used on the right-hand side of a from statement have to be rewritten.

🎯 Affected products1

  • go/github.com/openfga/openfga:<= 0.2.4

🔗 References (5)