Read the docs

openfga

Records27All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical6CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

openfga records in CISA KEV

No openfga vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Openfga 26 records HIGH Helm Charts 12 records LOW

Records

26 records in Openfga · all components

TI-2024-28441 CVE-2024-42473 · GHSA-3f6g-m4hr-59h8

OpenFGA Authorization Bypass

Priority MEDIUM 49

OpenFGA is an authorization/permission engine.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00527 Published 2024-08-09 Fixed in 1.5.9 CWE-863
TI-2022-07597 CVE-2022-23542 · GHSA-m3q4-7qmj-657m

OpenFGA Authorization Bypass

Priority MEDIUM 45

OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00988 Published 2022-12-20 Fixed in 0.3.1 CWE-285
TI-2024-20816 CVE-2024-31452 · GHSA-8cph-m685-6v6r

OpenFGA Authorization Bypass

Priority MEDIUM 44

OpenFGA is a high-performance and flexible authorization/permission engine.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00656 Published 2024-04-16 Fixed in 1.5.3 CWE-863
TI-2022-18717 CVE-2022-39342 · GHSA-f4mm-2r69-mg5f

OpenFGA Authorization Bypass

Priority MEDIUM 44

OpenFGA is an authorization/permission engine.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01142 Published 2022-10-25 Fixed in 0.2.4 CWE-285
TI-2022-18716 CVE-2022-39341 · GHSA-vj4m-83m8-xpw5

OpenFGA Authorization Bypass

Priority MEDIUM 44

OpenFGA is an authorization/permission engine.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01142 Published 2022-10-25 Fixed in 0.2.4 CWE-285
TI-2022-18727 CVE-2022-39352 · GHSA-3gfj-fxx4-f22w

OpenFGA Authorization Bypass

Priority MEDIUM 43

OpenFGA is a high-performance authorization/permission engine inspired by Google Zanzibar.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00507 Published 2022-11-08 Fixed in 0.2.5 CWE-863
TI-2026-27194 CVE-2026-34972 · GHSA-jwvj-g8pc-cx45

Incorrect authorization in openfga

Priority LOW 37

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00219 Published 2026-04-06 Partial fix · 1.14.0 CWE-863
TI-2026-29074 CVE-2026-40293 · GHSA-68m9-983m-f3v5

OpenFGA Playground Preshared Key Exposure

Priority LOW 35

OpenFGA is an authorization/permission engine built for developers.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00287 Published 2026-04-17 Partial fix · 1.14.0 CWE-200
TI-2023-24571 CVE-2023-45810 · GHSA-hr4f-6jh8-f2vq

OpenFGA denial of service

Priority LOW 34

OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00608 Published 2023-10-17 Fixed in 1.3.4 CWE-400
TI-2022-18715 CVE-2022-39340 · GHSA-95x7-mh78-7w2r

OpenFGA Information Disclosure

Priority LOW 32

OpenFGA is an authorization/permission engine.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00908 Published 2022-10-25 Fixed in 0.2.4 CWE-285
TI-2024-15814 CVE-2024-23820 · GHSA-rxpw-85vw-fx87

Resource allocation without limits in openfga

Priority LOW 30

OpenFGA, an authorization/permission engine, is vulnerable to a denial of service attack in versions prior to 1.4.3.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00734 Published 2024-01-26 Fixed in 1.4.3 CWE-770
TI-2023-21377 CVE-2023-40579 · GHSA-jcf2-mxr2-gmqp

OpenFGA Authorization Bypass

Priority LOW 30

OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00545 Published 2023-08-25 Fixed in 1.3.1 CWE-284
TI-2025-30697 CVE-2025-48371 · GHSA-c72g-53hw-82q7

OpenFGA Authorization Bypass

Priority LOW 27

OpenFGA is an authorization/permission engine.

CVSS 4.0MEDIUM 5.8 Network Low privileges No interaction EPSS 0.00503 Published 2025-05-22 Fixed in 1.8.13 CWE-285
TI-2026-26108 CVE-2026-33729 · GHSA-h6c8-cww8-35hf

OpenFGA has an Authorization Bypass through cached keys

Priority LOW 26

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.

CVSS 4.0MEDIUM 5.8 Network Low privileges No interaction EPSS 0.0025 Published 2026-03-27 Fixed in 1.13.1 CWE-1289
TI-2026-20050 CVE-2026-24851 · GHSA-jq9f-gm9w-rwm9

OpenFGA Improper Policy Enforcement

Priority LOW 26

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.

CVSS 4.0MEDIUM 5.8 Network Low privileges No interaction EPSS 0.00342 Published 2026-02-06 Partial fix · 1.11.3 CWE-863
TI-2025-40089 CVE-2025-64751 · GHSA-2c64-vmv2-hgfc

OpenFGA Improper Policy Enforcement

Priority LOW 26

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.

CVSS 4.0MEDIUM 5.8 Network Low privileges No interaction EPSS 0.00313 Published 2025-11-21 Fixed in 1.11.1 CWE-285
TI-2025-34888 CVE-2025-55213 · GHSA-mgh9-4mwp-fg55

OpenFGA Authorization Bypass (Check)

Priority LOW 26

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.

CVSS 4.0MEDIUM 5.8 Network Low privileges No interaction EPSS 0.00324 Published 2025-08-18 Partial fix · 1.9.5 CWE-863
TI-2025-29072 CVE-2025-46331 · GHSA-w222-m46c-mgh6

OpenFGA Authorization Bypass

Priority LOW 26

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.

CVSS 4.0MEDIUM 5.8 Network Low privileges No interaction EPSS 0.00395 Published 2025-04-30 Fixed in 1.8.11 CWE-284
TI-2025-18865 CVE-2025-25196 · GHSA-g4v5-6f5p-m38j

OpenFGA Authorization Bypass

Priority LOW 26

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.

CVSS 4.0MEDIUM 5.8 Network Low privileges No interaction EPSS 0.00434 Published 2025-02-19 Fixed in 1.8.5 CWE-285
TI-2024-37284 CVE-2024-56323 · GHSA-32q6-rr98-cjqv

OpenFGA Authorization Bypass

Priority LOW 26

OpenFGA is an authorization/permission engine.

CVSS 4.0MEDIUM 5.8 Network Low privileges No interaction EPSS 0.00442 Published 2025-01-13 Fixed in 1.8.3 CWE-285
TI-2026-29759 CVE-2026-41131 · GHSA-57j5-qwp2-vqp6

OpenFGA has Improper Policy Enforcement

Priority LOW 22

OpenFGA is an authorization/permission engine built for developers.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00145 Published 2026-04-21 Partial fix · 1.14.1 CWE-706
Load more
Open these records in search →