GHSA-c72g-53hw-82q7

OpenFGA v1.8.0 to v1.8.12 ( openfga-0.2.16 <= Helm chart <= openfga-0.2.31, v1.8.0 <= docker <= v.1.8.12) are vulnerable to authorization bypass when certain Check and ListObject calls are executed.

Am I Affected?

If you are using OpenFGA v1.8.0 to v1.8.12, specifically under the following conditions, you are affected by this authorization bypass vulnerability:

Calling Check API or ListObjects with an authorization model that has a relationship directly assignable by both type bound public access and userset, and
There are check or list object queries with contextual tuples for the relationship that can be directly assignable by both type bound public access and userset, and
Those contextual tuples’s user field is an userset, and
Type bound public access tuples are not assigned to the relationship

Fix

Upgrade to v1.8.13. This upgrade is backwards compatible.

Acknowledgments

OpenFGA would like to thank @udyvish for discovering this vulnerability.

Database specific

{
    "cwe_ids": [
        "CWE-285"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-05-23T18:41:38Z",
    "nvd_published_at": "2025-05-22T23:15:19Z",
    "severity": "MODERATE"
}

References

Affected packages

Go / github.com/openfga/openfga

Package

Name: github.com/openfga/openfga; View open source insights on deps.dev
Purl: pkg:golang/github.com/openfga/openfga

Affected ranges

Type: SEMVER
Events: Introduced

1.8.0

Fixed

1.8.13

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-c72g-53hw-82q7/GHSA-c72g-53hw-82q7.json"