Moderate severityNVD Advisory· Published Jan 13, 2025· Updated Jan 14, 2025
OpenFGA Authorization Bypass
CVE-2024-56323
Description
OpenFGA is an authorization/permission engine. IN OpenFGA v1.3.8 to v1.8.2 (Helm chart openfga-0.1.38 to openfga-0.2.19, docker v1.3.8 to v.1.8.2) are vulnerable to authorization bypass under the following conditions: 1. calling Check API or ListObjects with a model that uses conditions, and 2. calling Check API or ListObjects API with contextual tuples that include conditions and 3. OpenFGA is configured with caching enabled (OPENFGA_CHECK_QUERY_CACHE_ENABLED). Users are advised to upgrade to v1.8.3. There are no known workarounds for this vulnerability.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/openfga/openfgaGo | >= 1.3.8, < 1.8.3 | 1.8.3 |
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- github.com/advisories/GHSA-32q6-rr98-cjqvghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-56323ghsaADVISORY
- github.com/openfga/openfga/security/advisories/GHSA-32q6-rr98-cjqvghsax_refsource_CONFIRMWEB
- pkg.go.dev/vuln/GO-2025-3384ghsaWEB
News mentions
0No linked articles in our index yet.