CVE-2022-39340
mediumpriority · track · 21OT risk · elevatedEPSS 0.009 · 60 %ileEUUSEPSS · scored 2026-10-27
OpenFGA is an authorization/permission engine. Prior to version 0.2.4, the `streamed-list-objects` endpoint was not validating the authorization header, resulting in disclosure of objects in the store. Users `openfga/openfga` versions 0.2.3 and prior who are exposing the OpenFGA service to the internet are vulnerable. Version 0.2.4 contains a patch for this issue.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-95x7-mh78-7w2rOpenFGA subject to Information Disclosure via streamed-list-objects endpoint2022-10-25ghsa · osvUS
### Overview During our internal security assessment, it was discovered that `streamed-list-objects` endpoint was not validating the authorization header resulting in the disclosure of objects in the store. ### Am I Affected? You are affected by this vulnerability if you are using `openfga/openfga` version `v0.2.3` or prior and you are exposing the OpenFGA service to the internet. ### How to fix that? Upgrade to version `v0.2.4`. ### Backward Compatibility This update is backward compatible.
- GO-2022-1079OpenFGA subject to Information Disclosure via streamed-list-objects endpoint in github.com/openfga/openfga2024-08-21vendor · osvUS
OpenFGA subject to Information Disclosure via streamed-list-objects endpoint in github.com/openfga/openfga
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2022-39340/cnnvd
- https://github.com/openfga/openfga/commit/779d73d4b6d067ee042ec9b59fec707eed71e42fcnnvd
- https://github.com/openfga/openfga/releases/tag/v0.2.4cnnvd
- https://github.com/openfga/openfga/security/advisories/GHSA-95x7-mh78-7w2rcnnvd
- https://github.com/openfga/openfga/commit/779d73d4b6d067ee042ec9b59fec707eed71e42fenisa_euvd
- https://github.com/openfga/openfga/releases/tag/v0.2.4enisa_euvd
- https://github.com/openfga/openfga/security/advisories/GHSA-95x7-mh78-7w2renisa_euvd
- https://github.com/openfga/openfga/commit/779d73d4b6d067ee042ec9b59fec707eed71e42fPatchThird Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan