High severityNVD Advisory· Published Dec 20, 2022· Updated Apr 16, 2025
OpenFGA Authorization Bypass
CVE-2022-23542
Description
OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. During an internal security assessment, it was discovered that OpenFGA version 0.3.0 is vulnerable to authorization bypass under certain conditions. This issue has been patched in version 0.3.1 and is backward compatible.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/openfga/openfgaGo | >= 0.3.0, < 0.3.1 | 0.3.1 |
Affected products
2Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-m3q4-7qmj-657mghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-23542ghsaADVISORY
- github.com/openfga/openfga/pull/422ghsax_refsource_MISCWEB
- github.com/openfga/openfga/releases/tag/v0.3.1ghsax_refsource_MISCWEB
- github.com/openfga/openfga/security/advisories/GHSA-m3q4-7qmj-657mghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.