GHSA-32q6-rr98-cjqv: OpenFGA Authorization Bypass

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2024-56323

OpenFGA Authorization Bypass

Moderate severity GitHub Reviewed Published Jan 13, 2025 in openfga/openfga • Updated Jan 13, 2025

Package

gomod github.com/openfga/openfga (Go)

Affected versions

>= 1.3.8, < 1.8.3

Overview

OpenFGA v1.3.8 to v1.8.2 (Helm chart openfga-0.1.38 to openfga-0.2.19, docker v1.3.8 to v.1.8.2) are vulnerable to authorization bypass when certain Check and ListObject calls are executed.

Am I Affected?

You are affected by this authorization bypass vulnerability if you are using OpenFGA v1.3.8 to v1.8.2, specifically under the following conditions:

1. Calling Check API or ListObjects with a model that uses conditions, and
2. OpenFGA is configured with caching enabled (OPENFGA_CHECK_QUERY_CACHE_ENABLED), and
3. Check API call or ListObjects API calls contain contextual tuples that include conditions.

Fix

Upgrade to v1.8.3. This upgrade is backwards compatible.

References

• GHSA-32q6-rr98-cjqv

Published to the GitHub Advisory Database

Jan 13, 2025

Last updated

Jan 13, 2025