OpenFGA Authorization Bypass
CVE-2023-40579

6.5MEDIUM

Key Information:

Vendor

Openfga

Status
Openfga
Vendor
CVE Published:
25 August 2023

What is CVE-2023-40579?

OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. Some end users of OpenFGA v1.3.0 or earlier are vulnerable to authorization bypass when calling the ListObjects API. The vulnerability affects customers using ListObjects with specific models. The affected models contain expressions of type rel1 from type1. This issue has been patched in version 1.3.1.

Affected Version(s)

openfga < 1.3.1

References

https://github.com/openfga/openfga/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/openfga/openfga/releases/tag/v1.3.1
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.