Vulnerabilities

TI-2026-40204 CVE-2026-55689 · GHSA-hcxc-wf8j-23hv

OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset

LOW 35

OpenFGA is an authorization/permission engine built for developers.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00407 Published 2026-07-09 Partial fix · 1.18.0 CWE-287

TI-2026-39856 CVE-2026-55170 · GHSA-cf98-j28v-49v6

OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions

LOW 11

OpenFGA is an authorization/permission engine built for developers.

CVSS 4.0LOW 2.1 Network Low privileges User interaction EPSS 0.00339 Published 2026-07-09 Partial fix · 1.18.0 CWE-178

TI-2026-35536 CVE-2026-48096 · GHSA-8396-jffm-qx4w

Insufficient verification of data authenticity in openfga

LOW 23

OpenFGA is an authorization/permission engine built for developers.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00101 Published 2026-06-10 Partial fix · 1.16.0 CWE-345

TI-2026-29759 CVE-2026-41131 · GHSA-57j5-qwp2-vqp6

OpenFGA has Improper Policy Enforcement

LOW 22

OpenFGA is an authorization/permission engine built for developers.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00145 Published 2026-04-21 Partial fix · 1.14.1 CWE-706

TI-2026-27194 CVE-2026-34972 · GHSA-jwvj-g8pc-cx45

Incorrect authorization in openfga

LOW 37

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00219 Published 2026-04-06 Partial fix · 1.14.0 CWE-863

TI-2026-20050 CVE-2026-24851 · GHSA-jq9f-gm9w-rwm9

OpenFGA Improper Policy Enforcement

LOW 26

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.

CVSS 4.0MEDIUM 5.8 Network Low privileges No interaction EPSS 0.00342 Published 2026-02-06 Partial fix · 1.11.3 CWE-863

TI-2025-40089 CVE-2025-64751 · GHSA-2c64-vmv2-hgfc

OpenFGA Improper Policy Enforcement

LOW 26

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.

CVSS 4.0MEDIUM 5.8 Network Low privileges No interaction EPSS 0.00313 Published 2025-11-21 Fixed in 1.11.1 CWE-285

TI-2025-34888 CVE-2025-55213 · GHSA-mgh9-4mwp-fg55

OpenFGA Authorization Bypass (Check)

LOW 26

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.

CVSS 4.0MEDIUM 5.8 Network Low privileges No interaction EPSS 0.00343 Published 2025-08-18 Partial fix · 1.9.5 CWE-863

TI-2025-30697 CVE-2025-48371 · GHSA-c72g-53hw-82q7

OpenFGA Authorization Bypass

LOW 27

OpenFGA is an authorization/permission engine.

CVSS 4.0MEDIUM 5.8 Network Low privileges No interaction EPSS 0.00503 Published 2025-05-22 Fixed in 1.8.13 CWE-285

TI-2025-29072 CVE-2025-46331 · GHSA-w222-m46c-mgh6

OpenFGA Authorization Bypass

LOW 26

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.

CVSS 4.0MEDIUM 5.8 Network Low privileges No interaction EPSS 0.00395 Published 2025-04-30 Fixed in 1.8.11 CWE-284

TI-2025-18865 CVE-2025-25196 · GHSA-g4v5-6f5p-m38j

OpenFGA Authorization Bypass

LOW 26

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.

CVSS 4.0MEDIUM 5.8 Network Low privileges No interaction EPSS 0.00434 Published 2025-02-19 Fixed in 1.8.5 CWE-285

TI-2024-37284 CVE-2024-56323 · GHSA-32q6-rr98-cjqv

OpenFGA Authorization Bypass

LOW 26

OpenFGA is an authorization/permission engine.

CVSS 4.0MEDIUM 5.8 Network Low privileges No interaction EPSS 0.00442 Published 2025-01-13 Fixed in 1.8.3 CWE-285

Vulnerabilities

Filters