Improper Policy Enforcement in OpenFGA Authorization Engine
CVE-2025-64751

5.8MEDIUM

Key Information:

Vendor

Openfga

Status
Openfga
Vendor
CVE Published:
21 November 2025

What is CVE-2025-64751?

OpenFGA, a flexible authorization and permission engine inspired by Google Zanzibar, is susceptible to vulnerabilities due to improper policy enforcement. This flaw arises when certain Check and ListObject calls are executed, allowing potential security risks. Versions 1.4.0 to 1.11.0 are affected, but the issue has been resolved in version 1.11.1. It is crucial for developers using OpenFGA to upgrade to the latest version to maintain system security.

Affected Version(s)

openfga >= 1.4.0, < 1.11.1

References

https://github.com/openfga/openfga/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/openfga/openfga/releases/tag/v1.11.1
x_refsource_MISC

CVSS V4

Score:
5.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-64751 : Improper Policy Enforcement in OpenFGA Authorization Engine