CVE-2022-23542

### Overview During our internal security assessment, it was discovered that OpenFGA versions v0.3.0 is vulnerable to authorization bypass under certain conditions. ### Am I Affected? You are affected by this vulnerability if **all** of the following applies: 1. You are using OpenFGA v0.3.0 2. You created a model using modeling language v1.1 that applies a type restriction to an object e.g. `define viewer: [user]` 3. You created tuples based on the aforementioned model, e.g. `document:1#viewer@user:jon` 4. You updated the previous model by adding a new type and replacing the previous restriction with the newly added type e.g. `define viewer: [employee]` 5. You use the tuples created against the first model (step 3) and issue checks against the updated model e.g. `user=user:jon, relation=viewer, object:document:1` ### How to fix that? Upgrade to version v0.3.1 ### Backward Compatibility This update is backward compatible.

OpenFGA Authorization Bypass in github.com/openfga/openfga