OpenFGA Authorization Bypass

CRITICAL 9.8CVE-2025-55213 · GHSA-mgh9-4mwp-fg55 · GO-2025-3894 · Published 18/08/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
github.com/openfga/openfga Go	`≥ 1.9.3, < 1.9.5`	`1.9.5`
helm charts openfga	`≥ 0.2.40, < 0.2.42`	`0.2.42`
openfga openfga	`≥ 1.9.3, < 1.9.5`	`1.9.5`

Description

Overview

OpenFGA v1.9.3 to v1.9.4 ( openfga-0.2.40 <= Helm chart <= openfga-0.2.41, v1.9.3 <= docker <= v.1.9.4) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed.

Am I Affected?

You are affected by this vulnerability if you are using OpenFGA v1.9.3 to v1.9.4, specifically under the following preconditions:

Calling Check API or ListObjects with an authorization model that has a relationship directly assignable by more than 1 userset with same type, and
There are check or list object queries that rely on the above relationship, and
You have userset tuples that are assigned to the above relationship

Fix

Upgrade to v1.9.5. This upgrade is backwards compatible.

Workaround

Downgrade to v1.9.2 with enable-check-optimizations removed from OPENFGA_EXPERIMENTALS

Acknowledgments

OpenFGA would like Dominic Harries and rrozza-apolitical to thank for discovering this vulnerability.

NVD description

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.9.3 to v1.9.4 ( openfga-0.2.40 <= Helm chart <= openfga-0.2.41, v1.9.3 <= docker <= v.1.9.4) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed. This vulnerability is fixed in 1.9.5.

References

openfga/openfga security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-55213 · ADVISORY
openfga/openfga commit 1a7e0e3 · WEB
openfga/openfga · PACKAGE
pkg.go.dev/vuln/GO-2025-3894 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/openfga/openfga

≥ 1.9.3, < 1.9.5

1.9.5

helm charts

openfga

≥ 0.2.40, < 0.2.42

0.2.42

openfga

≥ 1.9.3, < 1.9.5

1.9.5

Description

Overview

Am I Affected?

You are affected by this vulnerability if you are using OpenFGA v1.9.3 to v1.9.4, specifically under the following preconditions:

Calling Check API or ListObjects with an authorization model that has a relationship directly assignable by more than 1 userset with same type, and
There are check or list object queries that rely on the above relationship, and
You have userset tuples that are assigned to the above relationship

Fix

Upgrade to v1.9.5. This upgrade is backwards compatible.

Workaround

Downgrade to v1.9.2 with enable-check-optimizations removed from OPENFGA_EXPERIMENTALS

Acknowledgments

OpenFGA would like Dominic Harries and rrozza-apolitical to thank for discovering this vulnerability.

NVD description