Read the docs
TI-2024-28441 Aliases CVE-2024-42473GHSA-3f6g-m4hr-59h8

OpenFGA Authorization Bypass

Priority MEDIUM 49CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

OpenFGA is an authorization/permission engine. OpenFGA v1.5.7 and v1.5.8 are vulnerable to authorization bypass when calling Check API with a model that uses `but not` and `from` expressions and a userset. Users should downgrade to v1.5.6 as soon as possible. This downgrade is backward compatible. As of time of publication, a patch is not available but OpenFGA's maintainers are planning a patch for inclusion in a future release.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00527 44th percentileScored 2026-11-07
Fix Fixed github.com/openfga/openfga (Go): 1.5.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openfgaopenfga1.5.7 – 1.5.8—No fix listedCNA
—github.com/openfga/openfga (Go)1.5.7 to before 1.5.91.5.9Patch availableGHSA-3f6g-m4hr-59h8
  • openfga Vendoropenfga Affected 1.5.7 – 1.5.8 Fixed in — No fix listed CNA
  • github.com/openfga/openfga (Go) Vendor— Affected 1.5.7 to before 1.5.9 Fixed in 1.5.9 Patch available GHSA-3f6g-m4hr-59h8

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:openfga:openfga:1.5.7:*:*:*:*:*:*:*1.5.7Vulnerableopenfga
cpe:2.3:a:openfga:openfga:1.5.8:*:*:*:*:*:*:*1.5.8Vulnerableopenfga
  • cpe:2.3:a:openfga:openfga:1.5.7:*:*:*:*:*:*:* Versions 1.5.7 Vulnerable ·openfga
  • cpe:2.3:a:openfga:openfga:1.5.8:*:*:*:*:*:*:* Versions 1.5.8 Vulnerable ·openfga

Remediation

  • Fix · GHSA-3f6g-m4hr-59h8 github.com/openfga/openfga (Go) Fixed in 1.5.9 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-42473
  2. 2026-10-03 Alias added: GHSA-3f6g-m4hr-59h8

References

Advisory 2

Other 1

  • TI-2023-17995 OpenFGA denial of service die to circular relationship CVSS 3.1HIGH 7.5
  • TI-2022-07597 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
  • TI-2024-20816 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
  • TI-2022-18717 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
  • TI-2022-18716 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
  • TI-2022-18727 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences