CVE-2026-24851
- Source
- https://cve.org/CVERecord?id=CVE-2026-24851
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24851.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-24851
- Aliases
- Downstream
CGA (32)
- CGA-2wgp-q933-xp6f
- CGA-55mc-gmr6-6p9r
- CGA-5874-r8c7-7wjj
- CGA-5g72-497r-f574
- CGA-5gc2-7p58-v7rm
- CGA-6xcr-3678-73pm
- CGA-7wc8-3f56-wpqg
- CGA-88qm-jf8q-xmp3
- CGA-8cqj-jjhm-2xh5
- CGA-8wvw-gcx2-rqg2
- CGA-93wm-226w-r54g
- CGA-98gh-6pr9-3xj3
- CGA-9ghv-mmw6-wj96
- CGA-9v3r-6pr7-mc2c
- CGA-c72g-7hwg-mg42
- CGA-cw49-hf5c-jfxh
- CGA-f4fr-5435-c6jv
- CGA-fq33-3m6j-2x4x
- CGA-p5vg-54ff-jhfq
- CGA-qff2-x2w4-c27w
- CGA-qxrx-v3c6-x5c9
- CGA-rh28-94hw-g8r7
- CGA-rqh2-jfqf-66hj
- CGA-rrq9-gx69-wrhr
- CGA-vj66-4grx-2fjf
- CGA-vmcw-pcxh-3c6x
- CGA-vq6h-8pgh-c7c8
- CGA-w2fv-rmjp-cc37
- CGA-w8rx-w725-p3rc
- CGA-wm2r-fr8c-8frp
- CGA-xgpc-j4pp-pp6j
- CGA-xj6j-856j-fgw2
MINI (14)
openSUSE (1)
SUSE (1)
- Related
- Published
- 2026-02-06T17:51:27Z
- Modified
- 2026-10-20T11:33:26Z
- Severity
-
- 5.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H CVSS Calculator
- Summary
- OpenFGA Improper Policy Enforcement
- Details
-
OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.8.5 to v1.11.2 ( openfga-0.2.22<= Helm chart <= openfga-0.2.51, v.1.8.5 <= docker <= v.1.11.2) are vulnerable to improper policy enforcement when certain Check calls are executed. The vulnerability requires a model that has a a relation directly assignable by a type bound public access and assignable by type bound non-public access, a tuple assigned for the relation that is a type bound public access, a tuple assigned for the same object with the same relation that is not type bound public access, and a tuple assigned for a different object that has an object ID lexicographically larger with the same user and relation which is not type bound public access. This vulnerability is fixed in v1.11.3.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-863" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24851.json" }- References
Affected packages
Git / github.com/openfga/helm-charts
Affected ranges
- Type
- GIT
- Repo
- https://github.com/openfga/helm-charts
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:openfga:helm_charts:*:*:*:*:*:openfga:*:*", "range": [ { "introduced": "0.2.22" }, { "fixed": "0.2.51" } ], "source": "CPE_RANGE" } ] }
- Type
- GIT
- Repo
- https://github.com/openfga/openfga
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "0" }, { "fixed": "1.11.3" }, { "cpe": "cpe:2.3:a:openfga:openfga:*:*:*:*:*:*:*:*", "range": [ { "introduced": "1.8.5" }, { "fixed": "1.11.3" } ], "source": "CPE_RANGE" }, { "original_tag": "v1.11.3", "range": [ { "fixed": "6e22a3e972bdb5bce1095694857a709c192b4936" } ], "source": "REFERENCES_TAG" } ], "source": "AFFECTED_FIELD" }