| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/openfga/openfga | < 1.13.1 | 1.13.1 |
| openfga | < 1.13.1 | 1.13.1 |
In OpenFGA, under specific conditions, models using conditions with caching enabled can result in two different check requests producing the same cache key. This can result in OpenFGA reusing an earlier cached result for a different request.
Users are affected if the following preconditions are met:
Upgrade to OpenFGA v1.13.1.
OpenFGA would like to thank @Amemoyoi for the discovery and responsible disclosure.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free