CVE-2025-46331
OpenFGA Authorization Bypass
Impact
Overview OpenFGA v1.8.10 or previous (Helm chart <= openfga-0.2.28, docker <= v.1.8.10) are vulnerable to authorization bypass when certain Check and ListObject calls are executed. Am I Affected? If you are using OpenFGA v1.8.10 or previous, specifically under the following conditions, you are affected by this authorization bypass vulnerability: - Calling Check API or ListObjects with an [authorization model](https://openfga.dev/docs/concepts#what-is-an-authorization-model) that has tuple cycle. - [Check query cache](https://github.com/openfga/openfga/blob/9b5974458b777707ed2a30ba6303699499e655ee/.config-schema.json#L528) is enabled, and - There are multiple check / list objects requests involving the tuple cycle within the check query TTL Fix Upgrade to v1.8.11. This upgrade is backwards compatible.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/openfga/openfga | >= 1.3.6, < 1.8.11 | 1.8.11 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openfga | Helm Charts | from 0.1.36 before 0.2.29 |
| Openfga | Openfga | from 1.3.6 before 1.8.11 |