Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

openfga — Vulnerabilities & Security Advisories 27

All 27 CVE vulnerabilities found in openfga, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerability data for the OpenFGA authorization engine, specifically focusing on logic flaws and access control weaknesses. The collection encompasses publicly disclosed issues ranging from early development stages to the most recent stable releases, covering a span of several years. Users can track the vendor's official security advisories, analyze the characteristics of permission bypass vulnerabilities common to fine-grained authorization systems, and review the complete historical record of security incidents affecting this product. The dataset enables security professionals to correlate specific weakness types with implementation details in OpenFGA, facilitating deeper understanding of how authorization models can be compromised. By examining the chronological progression of reported issues, teams can evaluate the maturity of the project's security posture and identify recurring patterns in their vulnerability landscape. This resource serves as a centralized reference for auditors, developers, and researchers needing to assess the risk profile of OpenFGA within their infrastructure without navigating fragmented sources. All entries are standardized to ensure consistency in classification and severity ratings, allowing for efficient filtering and comparison against industry benchmarks. The information presented here supports proactive defense strategies by highlighting historical gaps and current mitigation efforts related to authorization logic.

Vendor: openfga

CVE ID Title CVSS Severity Published
CVE-2026-61709 OpenFGA: ListUsers returns a deliberately-excluded user (authorization-decision over-inclusion) when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user CWE-281 5.3 Medium 2026-09-16
CVE-2026-55689 OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset CWE-287 6.8 Medium 2026-07-09
CVE-2026-55170 OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions CWE-178 - - 2026-07-09
CVE-2026-48096 OpenFGA: Cache-key delimiter injection in openfga/openfga shared-iterator and v2 iterator caches enables intra-store authorization-decision poisoning CWE-345 5.0 Medium 2026-06-10
CVE-2026-41131 OpenFGA has Improper Policy Enforcement CWE-863 5.0 Medium 2026-04-21
CVE-2026-40293 OpenFGA Playground Preshared Key Exposure CWE-200 6.5 Medium 2026-04-17
CVE-2026-34972 OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision CWE-863 5.0 Medium 2026-04-06
CVE-2026-33729 OpenFGA has an Authorization Bypass through cached keys CWE-20 3.7 - 2026-03-27
CVE-2026-24851 OpenFGA Improper Policy Enforcement CWE-863 9.8AI Critical AI 2026-02-06
CVE-2025-64751 OpenFGA Improper Policy Enforcement CWE-285 9.8 - 2025-11-21
CVE-2025-55213 OpenFGA Authorization Bypass (Check) CWE-863 9.8 - 2025-08-18
CVE-2025-48371 OpenFGA Authorization Bypass CWE-285 9.8AI Critical AI 2025-05-22
CVE-2025-46331 OpenFGA Authorization Bypass CWE-284 9.8AI Critical AI 2025-04-30
CVE-2025-25196 OpenFGA Authorization Bypass CWE-285 8.1 - 2025-02-19
CVE-2024-56323 OpenFGA Authorization Bypass CWE-285 9.8 - 2025-01-13
CVE-2024-42473 OpenFGA Authorization Bypass CWE-863 7.5 High 2024-08-09
CVE-2024-31452 OpenFGA Authorization Bypass CWE-863 8.1 High 2024-04-16
CVE-2024-23820 OpenFGA DoS CWE-770 5.3 Medium 2024-01-26
CVE-2023-45810 OpenFGA denial of service CWE-400 5.3 Medium 2023-10-17
CVE-2023-43645 Denial of service from circular relationship definitions in OpenFGA CWE-835 5.9 Medium 2023-09-26
CVE-2023-40579 OpenFGA Authorization Bypass CWE-284 6.5 Medium 2023-08-25
CVE-2023-35933 OpenFGA denial of service die to circular relationship CWE-835 5.9 Medium 2023-06-26
CVE-2022-23542 OpenFGA Authorization Bypass CWE-285 7.7 High 2022-12-20
CVE-2022-39352 OpenFGA Authorization Bypass CWE-863 4.8 Medium 2022-11-08
CVE-2022-39342 OpenFGA Authorization Bypass CWE-285 5.9 Medium 2022-10-25
CVE-2022-39341 OpenFGA Authorization Bypass CWE-285 5.9 Medium 2022-10-25
CVE-2022-39340 OpenFGA Information Disclosure CWE-285 5.3 Medium 2022-10-25

All 27 known CVE vulnerabilities affecting openfga with full Chinese analysis, references, and POCs where available.