Kurz gesagt
- CVE-2025-55213 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in github.com/openfga/openfga, helm charts (openfga), openfga (openfga).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.32%, höher als bei 25.4% aller Schwachstellen.
- Abhilfe: auf 1.9.5, 0.2.42 oder neuer aktualisieren.
Description
Overview
OpenFGA v1.9.3 to v1.9.4 ( openfga-0.2.40 <= Helm chart <= openfga-0.2.41, v1.9.3 <= docker <= v.1.9.4) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed.
Am I Affected?
You are affected by this vulnerability if you are using OpenFGA v1.9.3 to v1.9.4, specifically under the following preconditions:
- Calling Check API or ListObjects with an authorization model that has a relationship directly assignable by more than 1 userset with same type, and
- There are check or list object queries that rely on the above relationship, and
- You have userset tuples that are assigned to the above relationship
Fix
Upgrade to v1.9.5. This upgrade is backwards compatible.
Workaround
Downgrade to v1.9.2 with enable-check-optimizations removed from OPENFGA_EXPERIMENTALS
Acknowledgments
OpenFGA would like Dominic Harries and rrozza-apolitical to thank for discovering this vulnerability.
NVD description
OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.9.3 to v1.9.4 ( openfga-0.2.40 <= Helm chart <= openfga-0.2.41, v1.9.3 <= docker <= v.1.9.4) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed. This vulnerability is fixed in 1.9.5.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free