GHSA-jwvj-g8pc-cx45

Suggest an improvement
Source
https://github.com/advisories/GHSA-jwvj-g8pc-cx45
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-jwvj-g8pc-cx45/GHSA-jwvj-g8pc-cx45.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-jwvj-g8pc-cx45
Aliases
Downstream
Published
2026-04-07T18:05:16Z
Modified
2026-09-10T03:50:44Z
Severity
  • 5.0 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision
Details

Description

In OpenFGA, under specific conditions, BatchCheck calls with multiple checks sent for the same object, relation, and user combination can result in improper policy enforcement.

Am I affected?

You are affected if you meet the following preconditions:

  1. You execute BatchCheck operations which rely on context.
  2. Multiple checks are sent within a single BatchCheck operation for the same user/object/relation combination, each containing context.
  3. The contexts between those checks differ in a specific way

Fix

Upgrade to OpenFGA v1.14.0

Acknowledgement

OpenFGA would like to thank @bugbunny-research for the discovery and detailed report.

Database specific 
{
    "cwe_ids": [
        "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-07T18:05:16Z",
    "nvd_published_at": "2026-04-06T21:16:19Z",
    "severity": "MODERATE"
}
References

Affected packages

Go / github.com/openfga/openfga

Package

Name
github.com/openfga/openfga
View open source insights on deps.dev
Purl
pkg:golang/github.com/openfga/openfga

Affected ranges

Type
SEMVER
Events
Introduced
1.8.0
Fixed
1.14.0

Database specific

last_known_affected_version_range 
"<= 1.13.1"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-jwvj-g8pc-cx45/GHSA-jwvj-g8pc-cx45.json"