high8.1
CVE-2024-31452
OpenFGA Authorization Bypass
Impact
# Overview Some end users of OpenFGA v1.5.0 or later are vulnerable to authorization bypass when calling Check or ListObjects APIs. # Am I Affected? You are very likely affected if your model involves exclusion (e.g. `a but not b`) or intersection (e.g. `a and b`) and you have any cyclical relationships. If you are using these, please update as soon as possible. # Fix Update to v1.5.3 # Backward Compatibility This update is backward compatible.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/openfga/openfga | >= 1.5.0, < 1.5.3 | 1.5.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openfga | Openfga | from 1.5.0 before 1.5.3 |