CVE-2024-42473

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-42473

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-42473.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-42473

Aliases

Published

2024-08-09T21:16:17.683Z

Modified

2026-04-10T05:16:05.830183Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

OpenFGA Authorization Bypass

Details

OpenFGA is an authorization/permission engine. OpenFGA v1.5.7 and v1.5.8 are vulnerable to authorization bypass when calling Check API with a model that uses but not and from expressions and a userset. Users should downgrade to v1.5.6 as soon as possible. This downgrade is backward compatible. As of time of publication, a patch is not available but OpenFGA's maintainers are planning a patch for inclusion in a future release.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42473.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-863"
    ]
}

References

Affected packages

Git / github.com/openfga/openfga

Affected ranges

Type: GIT
Repo: https://github.com/openfga/openfga
Events: Introduced

b57290210f0ab46b4ab7dbcdde10206ec9f32c8e

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-42473.json"