High severityNVD Advisory· Published Dec 20, 2022· Updated Apr 16, 2025
OpenFGA Authorization Bypass
CVE-2022-23542
Description
OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. During an internal security assessment, it was discovered that OpenFGA version 0.3.0 is vulnerable to authorization bypass under certain conditions. This issue has been patched in version 0.3.1 and is backward compatible.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/openfga/openfgaGo | >= 0.3.0, < 0.3.1 | 0.3.1 |
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
5- github.com/advisories/GHSA-m3q4-7qmj-657mghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-23542ghsaADVISORY
- github.com/openfga/openfga/pull/422ghsax_refsource_MISCWEB
- github.com/openfga/openfga/releases/tag/v0.3.1ghsax_refsource_MISCWEB
- github.com/openfga/openfga/security/advisories/GHSA-m3q4-7qmj-657mghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.