Read the docs
TI-2024-20816 Aliases CVE-2024-31452GHSA-8cph-m685-6v6r

OpenFGA Authorization Bypass

Priority MEDIUM 44CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

OpenFGA is a high-performance and flexible authorization/permission engine. Some end users of OpenFGA v1.5.0 or later are vulnerable to authorization bypass when calling Check or ListObjects APIs. You are very likely affected if your model involves exclusion (e.g. `a but not b`) or intersection (e.g. `a and b`). This vulnerability is fixed in v1.5.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00656 51st percentileScored 2026-11-07
Fix Fixed openfga (openfga): 1.5.3github.com/openfga/openfga (Go): 1.5.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openfgaopenfga1.5.0 to before 1.5.31.5.3Patch availableCNA
—github.com/openfga/openfga (Go)1.5.0 to before 1.5.31.5.3Patch availableGHSA-8cph-m685-6v6r
  • openfga Vendoropenfga Affected 1.5.0 to before 1.5.3 Fixed in 1.5.3 Patch available CNA
  • github.com/openfga/openfga (Go) Vendor— Affected 1.5.0 to before 1.5.3 Fixed in 1.5.3 Patch available GHSA-8cph-m685-6v6r

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openfga:openfga:*:*:*:*:*:*:*:*1.5.0 to before 1.5.3Vulnerableopenfga
  • cpe:2.3:a:openfga:openfga:*:*:*:*:*:*:*:* Versions 1.5.0 to before 1.5.3 Vulnerable ·openfga

Remediation

  • Fix · CNA openfga (openfga) Fixed in 1.5.3
  • Fix · GHSA-8cph-m685-6v6r github.com/openfga/openfga (Go) Fixed in 1.5.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-31452
  2. 2026-10-03 Alias added: GHSA-8cph-m685-6v6r
  3. 2026-10-13 EPSS moved to the 50th–90th percentile

References

Patch 2

Advisory 1

Other 1

  • TI-2023-17995 OpenFGA denial of service die to circular relationship CVSS 3.1HIGH 7.5
  • TI-2024-28441 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
  • TI-2022-07597 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
  • TI-2022-18717 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
  • TI-2022-18716 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
  • TI-2022-18727 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences