CVE-2024-31452
criticalpriority · track · 39OT risk · elevatedEPSS 0.007 · 51 %ileEUUSEPSS · scored 2026-10-27
OpenFGA is a high-performance and flexible authorization/permission engine. Some end users of OpenFGA v1.5.0 or later are vulnerable to authorization bypass when calling Check or ListObjects APIs. You are very likely affected if your model involves exclusion (e.g. `a but not b`) or intersection (e.g. `a and b`). This vulnerability is fixed in v1.5.3.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.1–9.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-8cph-m685-6v6rOpenFGA Authorization Bypass2024-04-16ghsa · osvUS
# Overview Some end users of OpenFGA v1.5.0 or later are vulnerable to authorization bypass when calling Check or ListObjects APIs. # Am I Affected? You are very likely affected if your model involves exclusion (e.g. `a but not b`) or intersection (e.g. `a and b`) and you have any cyclical relationships. If you are using these, please update as soon as possible. # Fix Update to v1.5.3 # Backward Compatibility This update is backward compatible.
- GO-2024-2729OpenFGA Authorization Bypass in github.com/openfga/openfga2024-06-04vendor · osvUS
OpenFGA Authorization Bypass in github.com/openfga/openfga
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2024-31452cnnvd
- https://cxsecurity.com/cveshow/CVE-2024-31452/cnnvd
- https://github.com/openfga/openfga/commit/b6a6d99b2bdbf8c3781503989576076289f48ed2cnnvd
- https://github.com/openfga/openfga/security/advisories/GHSA-8cph-m685-6v6rcnnvd
- https://github.com/openfga/openfga/commit/b6a6d99b2bdbf8c3781503989576076289f48ed2enisa_euvd
- https://github.com/openfga/openfga/security/advisories/GHSA-8cph-m685-6v6renisa_euvd
- https://github.com/openfga/openfga/commit/b6a6d99b2bdbf8c3781503989576076289f48ed2Patchnvd
- https://github.com/openfga/openfga/security/advisories/GHSA-8cph-m685-6v6rPatchVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan