Description
OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. Some end users of OpenFGA v1.3.0 or earlier are vulnerable to authorization bypass when calling the ListObjects API. The vulnerability affects customers using `ListObjects` with specific models. The affected models contain expressions of type `rel1 from type1`. This issue has been patched in version 1.3.1.
Published: 2023-08-25
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2023-2315 OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. Some end users of OpenFGA v1.3.0 or earlier are vulnerable to authorization bypass when calling the ListObjects API. The vulnerability affects customers using `ListObjects` with specific models. The affected models contain expressions of type `rel1 from type1`. This issue has been patched in version 1.3.1.
Github GHSA Github GHSA GHSA-jcf2-mxr2-gmqp OpenFGA Authorization Bypass
History

Tue, 01 Oct 2024 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Openfga Openfga
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2024-10-01T16:09:10.601Z

Reserved: 2023-08-16T18:24:02.391Z

Link: CVE-2023-40579

cve-icon Vulnrichment

Updated: 2024-08-02T18:38:50.698Z

cve-icon NVD

Status : Modified

Published: 2023-08-25T20:15:08.800

Modified: 2024-11-21T08:19:45.210

Link: CVE-2023-40579

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses