OpenFGA Authorization Bypass

CRITICAL 9.8CVE-2025-46331 · GHSA-w222-m46c-mgh6 · GO-2025-3657 · Published 30/04/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
github.com/openfga/openfga Go	`≥ 1.3.6, < 1.8.11`	`1.8.11`
helm charts openfga	`≥ 0.1.36, < 0.2.29`	`0.2.29`
openfga openfga	`≥ 1.3.6, < 1.8.11`	`1.8.11`

Description

Overview OpenFGA v1.8.10 or previous (Helm chart <= openfga-0.2.28, docker <= v.1.8.10) are vulnerable to authorization bypass when certain Check and ListObject calls are executed.

Am I Affected? If you are using OpenFGA v1.8.10 or previous, specifically under the following conditions, you are affected by this authorization bypass vulnerability:

Calling Check API or ListObjects with an authorization model that has tuple cycle.
Check query cache is enabled, and
There are multiple check / list objects requests involving the tuple cycle within the check query TTL

Fix Upgrade to v1.8.11. This upgrade is backwards compatible.

NVD description

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.8.10 to v1.3.6 (Helm chart <= openfga-0.2.28, docker <= v.1.8.10) are vulnerable to authorization bypass when certain Check and ListObject calls are executed. This issue has been patched in version 1.8.11.

References

openfga/openfga security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-46331 · ADVISORY
openfga/openfga commit 244302e · WEB
openfga/openfga · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/openfga/openfga

≥ 1.3.6, < 1.8.11

1.8.11

helm charts

openfga

≥ 0.1.36, < 0.2.29

0.2.29

openfga

≥ 1.3.6, < 1.8.11

1.8.11

Description

Overview OpenFGA v1.8.10 or previous (Helm chart <= openfga-0.2.28, docker <= v.1.8.10) are vulnerable to authorization bypass when certain Check and ListObject calls are executed.

Am I Affected? If you are using OpenFGA v1.8.10 or previous, specifically under the following conditions, you are affected by this authorization bypass vulnerability:

Calling Check API or ListObjects with an authorization model that has tuple cycle.
Check query cache is enabled, and
There are multiple check / list objects requests involving the tuple cycle within the check query TTL

Fix Upgrade to v1.8.11. This upgrade is backwards compatible.

NVD description