Authorization Bypass in OpenFGA Affecting Multiple Versions
CVE-2025-48371

5.8MEDIUM

Key Information:

Vendor

Openfga

Status
Openfga
Vendor
CVE Published:
22 May 2025

What is CVE-2025-48371?

OpenFGA, an authorization and permission engine, experiences an authorization bypass vulnerability in versions 1.8.0 through 1.8.12. This vulnerability occurs when certain Check and ListObject API calls are executed under specific conditions including relationships assignable by public access and user sets. Affected users should upgrade to version 1.8.13 to secure their systems, as this patch is designed to be backwards compatible.

Affected Version(s)

openfga >= 1.8.0, < 1.8.13

References

https://github.com/openfga/openfga/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/openfga/openfga/commit/e5960d4eba92b72...
x_refsource_MISC

CVSS V4

Score:
5.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.