TI-2022-18716 Aliases CVE-2022-39341 GHSA-vj4m-83m8-xpw5

OpenFGA Authorization Bypass

MEDIUM 44CWE-285Published 2022-10-25 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass under certain conditions. Users who have wildcard (`*`) defined on tupleset relations in their authorization model are vulnerable. Version 0.2.4 contains a patch for this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01142 66th percentileScored 2026-11-07

Fix Fixed openfga (openfga): 0.2.4github.com/openfga/openfga (Go): 0.2.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
openfga	openfga	before 0.2.4	0.2.4	Patch available	CNA
—	github.com/openfga/openfga (Go)	before 0.2.4	0.2.4	Patch available	GHSA-vj4m-83m8-xpw5

openfga Vendoropenfga Affected before 0.2.4 Fixed in 0.2.4 Patch available CNA
github.com/openfga/openfga (Go) Vendor— Affected before 0.2.4 Fixed in 0.2.4 Patch available GHSA-vj4m-83m8-xpw5

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:openfga:openfga::::::::	before 0.2.4	Vulnerable	openfga

cpe:2.3:a:openfga:openfga:*:*:*:*:*:*:*:* Versions before 0.2.4 Vulnerable ·openfga

Remediation

Fix · CNA openfga (openfga) Fixed in 0.2.4
Fix · GHSA-vj4m-83m8-xpw5 github.com/openfga/openfga (Go) Fixed in 0.2.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-39341
2026-10-03 Alias added: GHSA-vj4m-83m8-xpw5

References

Patch 1

https://github.com/openfga/openfga/commit/b466769cc100b2065047786578718d313f52695b

Advisory 3

Other 1

https://github.com/openfga/openfga

TI-2023-17995 OpenFGA denial of service die to circular relationship CVSS 3.1HIGH 7.5
TI-2024-28441 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
TI-2022-07597 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
TI-2024-20816 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
TI-2022-18717 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
TI-2022-18727 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8

See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences