Vulnerabilities

TI-2026-44173 CVE-2026-61709 · GHSA-g3pg-frfm-pr2m

Incorrect authorization in openfga

LOW 24

OpenFGA is an authorization and permission engine built for developers.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00351 Published 2026-09-16 Partial fix · 1.18.1 CWE-281

TI-2026-40204 CVE-2026-55689 · GHSA-hcxc-wf8j-23hv

OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset

LOW 35

OpenFGA is an authorization/permission engine built for developers.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00407 Published 2026-07-09 Partial fix · 1.18.0 CWE-287

TI-2026-39856 CVE-2026-55170 · GHSA-cf98-j28v-49v6

OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions

LOW 11

OpenFGA is an authorization/permission engine built for developers.

CVSS 4.0LOW 2.1 Network Low privileges User interaction EPSS 0.00339 Published 2026-07-09 Partial fix · 1.18.0 CWE-178

TI-2026-35536 CVE-2026-48096 · GHSA-8396-jffm-qx4w

Insufficient verification of data authenticity in openfga

LOW 23

OpenFGA is an authorization/permission engine built for developers.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00101 Published 2026-06-10 Partial fix · 1.16.0 CWE-345

TI-2026-29759 CVE-2026-41131 · GHSA-57j5-qwp2-vqp6

OpenFGA has Improper Policy Enforcement

LOW 22

OpenFGA is an authorization/permission engine built for developers.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00145 Published 2026-04-21 Partial fix · 1.14.1 CWE-706

TI-2026-29074 CVE-2026-40293 · GHSA-68m9-983m-f3v5

OpenFGA Playground Preshared Key Exposure

LOW 35

OpenFGA is an authorization/permission engine built for developers.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00287 Published 2026-04-17 Partial fix · 1.14.0 CWE-200

TI-2026-27194 CVE-2026-34972 · GHSA-jwvj-g8pc-cx45

Incorrect authorization in openfga

LOW 37

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00219 Published 2026-04-06 Partial fix · 1.14.0 CWE-863

TI-2026-26108 CVE-2026-33729 · GHSA-h6c8-cww8-35hf

OpenFGA has an Authorization Bypass through cached keys

LOW 26

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.

CVSS 4.0MEDIUM 5.8 Network Low privileges No interaction EPSS 0.0025 Published 2026-03-27 Fixed in 1.13.1 CWE-1289

TI-2026-20050 CVE-2026-24851 · GHSA-jq9f-gm9w-rwm9

OpenFGA Improper Policy Enforcement

LOW 26

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.

CVSS 4.0MEDIUM 5.8 Network Low privileges No interaction EPSS 0.00342 Published 2026-02-06 Partial fix · 1.11.3 CWE-863

TI-2025-40089 CVE-2025-64751 · GHSA-2c64-vmv2-hgfc

OpenFGA Improper Policy Enforcement

LOW 26

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.

CVSS 4.0MEDIUM 5.8 Network Low privileges No interaction EPSS 0.00313 Published 2025-11-21 Fixed in 1.11.1 CWE-285

TI-2025-34888 CVE-2025-55213 · GHSA-mgh9-4mwp-fg55

OpenFGA Authorization Bypass (Check)

LOW 26

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.

CVSS 4.0MEDIUM 5.8 Network Low privileges No interaction EPSS 0.00324 Published 2025-08-18 Partial fix · 1.9.5 CWE-863

TI-2025-30697 CVE-2025-48371 · GHSA-c72g-53hw-82q7

OpenFGA Authorization Bypass

LOW 27

OpenFGA is an authorization/permission engine.

CVSS 4.0MEDIUM 5.8 Network Low privileges No interaction EPSS 0.00503 Published 2025-05-22 Fixed in 1.8.13 CWE-285

TI-2025-29072 CVE-2025-46331 · GHSA-w222-m46c-mgh6

OpenFGA Authorization Bypass

LOW 26

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.

CVSS 4.0MEDIUM 5.8 Network Low privileges No interaction EPSS 0.00395 Published 2025-04-30 Fixed in 1.8.11 CWE-284

TI-2025-18865 CVE-2025-25196 · GHSA-g4v5-6f5p-m38j

OpenFGA Authorization Bypass

LOW 26

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.

CVSS 4.0MEDIUM 5.8 Network Low privileges No interaction EPSS 0.00434 Published 2025-02-19 Fixed in 1.8.5 CWE-285

TI-2024-37284 CVE-2024-56323 · GHSA-32q6-rr98-cjqv

OpenFGA Authorization Bypass

LOW 26

OpenFGA is an authorization/permission engine.

CVSS 4.0MEDIUM 5.8 Network Low privileges No interaction EPSS 0.00442 Published 2025-01-13 Fixed in 1.8.3 CWE-285

TI-2024-28441 CVE-2024-42473 · GHSA-3f6g-m4hr-59h8

OpenFGA Authorization Bypass

MEDIUM 49

OpenFGA is an authorization/permission engine.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00527 Published 2024-08-09 Fixed in 1.5.9 CWE-863

TI-2024-20816 CVE-2024-31452 · GHSA-8cph-m685-6v6r

OpenFGA Authorization Bypass

MEDIUM 44

OpenFGA is a high-performance and flexible authorization/permission engine.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00656 Published 2024-04-16 Fixed in 1.5.3 CWE-863

TI-2024-15814 CVE-2024-23820 · GHSA-rxpw-85vw-fx87

Resource allocation without limits in openfga

LOW 30

OpenFGA, an authorization/permission engine, is vulnerable to a denial of service attack in versions prior to 1.4.3.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00734 Published 2024-01-26 Fixed in 1.4.3 CWE-770

TI-2023-24571 CVE-2023-45810 · GHSA-hr4f-6jh8-f2vq

OpenFGA denial of service

LOW 34

OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00608 Published 2023-10-17 Fixed in 1.3.4 CWE-400

TI-2023-23371 CVE-2023-43645 · GHSA-2hm9-h873-pgqh

Denial of service from circular relationship definitions in OpenFGA

LOW 28

OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00937 Published 2023-09-26 Fixed in 1.3.2 CWE-835

TI-2023-21377 CVE-2023-40579 · GHSA-jcf2-mxr2-gmqp

OpenFGA Authorization Bypass

LOW 30

OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00545 Published 2023-08-25 Fixed in 1.3.1 CWE-284

TI-2023-17995 CVE-2023-35933 · GHSA-hr9r-8phq-5x8j

OpenFGA denial of service die to circular relationship

HIGH 66

OPenFGA is an open source authorization/permission engine built for developers.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01133 Published 2023-06-26 Fixed in 1.1.1 CWE-835

TI-2022-07597 CVE-2022-23542 · GHSA-m3q4-7qmj-657m

OpenFGA Authorization Bypass

MEDIUM 45

OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00988 Published 2022-12-20 Fixed in 0.3.1 CWE-285

TI-2022-18727 CVE-2022-39352 · GHSA-3gfj-fxx4-f22w

OpenFGA Authorization Bypass

MEDIUM 43

OpenFGA is a high-performance authorization/permission engine inspired by Google Zanzibar.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00507 Published 2022-11-08 Fixed in 0.2.5 CWE-863

TI-2022-18717 CVE-2022-39342 · GHSA-f4mm-2r69-mg5f

OpenFGA Authorization Bypass

MEDIUM 44

OpenFGA is an authorization/permission engine.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01142 Published 2022-10-25 Fixed in 0.2.4 CWE-285

Vulnerabilities

Filters