TI-2022-18717 Aliases CVE-2022-39342 GHSA-f4mm-2r69-mg5f

OpenFGA Authorization Bypass

MEDIUM 44CWE-285Published 2022-10-25 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass under certain conditions. Users whose model has a relation defined as a tupleset (the right hand side of a ‘from’ statement) that involves anything other than a direct relationship (e.g. ‘as self’) are vulnerable. Version 0.2.4 contains a patch for this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01142 66th percentileScored 2026-11-07

Fix Fixed openfga (openfga): 0.2.4github.com/openfga/openfga (Go): 0.2.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
openfga	openfga	before 0.2.4	0.2.4	Patch available	CNA
—	github.com/openfga/openfga (Go)	before 0.2.4	0.2.4	Patch available	GHSA-f4mm-2r69-mg5f

openfga Vendoropenfga Affected before 0.2.4 Fixed in 0.2.4 Patch available CNA
github.com/openfga/openfga (Go) Vendor— Affected before 0.2.4 Fixed in 0.2.4 Patch available GHSA-f4mm-2r69-mg5f

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:openfga:openfga::::::::	before 0.2.4	Vulnerable	openfga

cpe:2.3:a:openfga:openfga:*:*:*:*:*:*:*:* Versions before 0.2.4 Vulnerable ·openfga

Remediation

Fix · CNA openfga (openfga) Fixed in 0.2.4
Fix · GHSA-f4mm-2r69-mg5f github.com/openfga/openfga (Go) Fixed in 0.2.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-39342
2026-10-03 Alias added: GHSA-f4mm-2r69-mg5f

References

Patch 1

https://github.com/openfga/openfga/commit/c8db1ee3d2a366f18e585dd33236340e76e784c4

Advisory 3

Other 1

https://github.com/openfga/openfga

TI-2023-17995 OpenFGA denial of service die to circular relationship CVSS 3.1HIGH 7.5
TI-2024-28441 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
TI-2022-07597 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
TI-2024-20816 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
TI-2022-18716 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
TI-2022-18727 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8

See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences