GHSA-jcf2-mxr2-gmqp

Source

https://github.com/advisories/GHSA-jcf2-mxr2-gmqp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/08/GHSA-jcf2-mxr2-gmqp/GHSA-jcf2-mxr2-gmqp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-jcf2-mxr2-gmqp

Aliases

Related

CVE-2023-40579

Published

2023-08-25T19:45:57Z

Modified

2024-08-21T14:41:43.299891Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

OpenFGA Authorization Bypass

Details

Overview

Some end users of OpenFGA v1.3.0 or earlier are vulnerable to authorization bypass when calling the ListObjects API. This means that the API sometimes returns more objects than it should.

Am I Affected?

The vulnerability affects customers using ListObjects with specific models. The affected models contain expressions of type rel1 from type1.

Fix

Update to v1.3.1.

Backward Compatibility

This update is backward compatible.

Database specific

{
    "nvd_published_at": "2023-08-25T20:15:08Z",
    "cwe_ids": [
        "CWE-284"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-25T19:45:57Z"
}

References

Affected packages

Go / github.com/openfga/openfga

Package

Name: github.com/openfga/openfga; View open source insights on deps.dev
Purl: pkg:golang/github.com/openfga/openfga

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.3.1