Read the docs
TI-2025-18865 Aliases CVE-2025-25196GHSA-g4v5-6f5p-m38j

OpenFGA Authorization Bypass

Priority LOW 26CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA < v1.8.4 (Helm chart < openfga-0.2.22, docker < v.1.8.4) are vulnerable to authorization bypass when certain Check and ListObject calls are executed. Users on OpenFGA v1.8.4 or previous, specifically under the following conditions are affected by this authorization bypass vulnerability: 1. Calling Check API or ListObjects with a model that has a relation directly assignable to both public access AND userset with the same type. 2. A type bound public access tuple is assigned to an object. 3. userset tuple is not assigned to the same object. and 4. Check request's user field is a userset that has the same type as the type bound public access tuple's user type. Users are advised to upgrade to v1.8.5 which is backwards compatible. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00434 37th percentileScored 2026-11-07
Fix Fixed openfga (openfga): 1.8.5github.com/openfga/openfga (Go): 1.8.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openfgaopenfgabefore 1.8.51.8.5Patch availableCNA
—github.com/openfga/openfga (Go)before 1.8.51.8.5Patch availableGHSA-g4v5-6f5p-m38j
  • openfga Vendoropenfga Affected before 1.8.5 Fixed in 1.8.5 Patch available CNA
  • github.com/openfga/openfga (Go) Vendor— Affected before 1.8.5 Fixed in 1.8.5 Patch available GHSA-g4v5-6f5p-m38j

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:openfga:helm_charts:*:*:*:*:*:*:*:*before 0.2.22Vulnerableopenfga
cpe:2.3:a:openfga:openfga:*:*:*:*:*:*:*:*before 1.8.5Vulnerableopenfga
  • cpe:2.3:a:openfga:helm_charts:*:*:*:*:*:*:*:* Versions before 0.2.22 Vulnerable ·openfga
  • cpe:2.3:a:openfga:openfga:*:*:*:*:*:*:*:* Versions before 1.8.5 Vulnerable ·openfga

Remediation

  • Fix · CNA openfga (openfga) Fixed in 1.8.5
  • Fix · GHSA-g4v5-6f5p-m38j github.com/openfga/openfga (Go) Fixed in 1.8.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-25196
  2. 2026-10-03 Alias added: GHSA-g4v5-6f5p-m38j

References

Patch 1

Advisory 2

Other 1

  • TI-2026-27194 Incorrect authorization in openfga CVSS 3.1HIGH 8.8
  • TI-2026-40204 OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset CVSS 3.1HIGH 8.1
  • TI-2025-30697 OpenFGA Authorization Bypass CVSS 4.0MEDIUM 5.8
  • TI-2026-20050 OpenFGA Improper Policy Enforcement CVSS 4.0MEDIUM 5.8
  • TI-2025-40089 OpenFGA Improper Policy Enforcement CVSS 4.0MEDIUM 5.8
  • TI-2025-34888 OpenFGA Authorization Bypass (Check) CVSS 4.0MEDIUM 5.8
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences