CVE-2022-23542
OpenFGA Authorization Bypass
Impact
### Overview During our internal security assessment, it was discovered that OpenFGA versions v0.3.0 is vulnerable to authorization bypass under certain conditions. ### Am I Affected? You are affected by this vulnerability if **all** of the following applies: 1. You are using OpenFGA v0.3.0 2. You created a model using modeling language v1.1 that applies a type restriction to an object e.g. `define viewer: [user]` 3. You created tuples based on the aforementioned model, e.g. `document:1#viewer@user:jon` 4. You updated the previous model by adding a new type and replacing the previous restriction with the newly added type e.g. `define viewer: [employee]` 5. You use the tuples created against the first model (step 3) and issue checks against the updated model e.g. `user=user:jon, relation=viewer, object:document:1` ### How to fix that? Upgrade to version v0.3.1 ### Backward Compatibility This update is backward compatible.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/openfga/openfga | = 0.3.0 | 0.3.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openfga | Openfga | before 0.3.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/openfga/openfga/pull/422
- https://github.com/openfga/openfga/releases/tag/v0.3.1
- https://github.com/openfga/openfga/security/advisories/GHSA-m3q4-7qmj-657m
- https://github.com/advisories/GHSA-m3q4-7qmj-657m
- https://nvd.nist.gov/vuln/detail/CVE-2022-23542