TI-2022-18715 Aliases CVE-2022-39340 GHSA-95x7-mh78-7w2r

OpenFGA Information Disclosure

LOW 32CWE-285Published 2022-10-25 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

OpenFGA is an authorization/permission engine. Prior to version 0.2.4, the `streamed-list-objects` endpoint was not validating the authorization header, resulting in disclosure of objects in the store. Users `openfga/openfga` versions 0.2.3 and prior who are exposing the OpenFGA service to the internet are vulnerable. Version 0.2.4 contains a patch for this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00908 60th percentileScored 2026-11-07

Fix Fixed openfga (openfga): 0.2.4github.com/openfga/openfga (Go): 0.2.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
openfga	openfga	before 0.2.4	0.2.4	Patch available	CNA
—	github.com/openfga/openfga (Go)	before 0.2.4	0.2.4	Patch available	GHSA-95x7-mh78-7w2r

openfga Vendoropenfga Affected before 0.2.4 Fixed in 0.2.4 Patch available CNA
github.com/openfga/openfga (Go) Vendor— Affected before 0.2.4 Fixed in 0.2.4 Patch available GHSA-95x7-mh78-7w2r

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:openfga:openfga::::::::	before 0.2.4	Vulnerable	openfga

cpe:2.3:a:openfga:openfga:*:*:*:*:*:*:*:* Versions before 0.2.4 Vulnerable ·openfga

Remediation

Fix · CNA openfga (openfga) Fixed in 0.2.4
Fix · GHSA-95x7-mh78-7w2r github.com/openfga/openfga (Go) Fixed in 0.2.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-39340
2026-10-03 Alias added: GHSA-95x7-mh78-7w2r

References

Patch 1

https://github.com/openfga/openfga/commit/779d73d4b6d067ee042ec9b59fec707eed71e42f

Advisory 3

Other 1

https://github.com/openfga/openfga

TI-2023-17995 OpenFGA denial of service die to circular relationship CVSS 3.1HIGH 7.5
TI-2024-28441 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
TI-2022-07597 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
TI-2024-20816 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
TI-2022-18717 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
TI-2022-18716 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8

See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences