Em resumo
- CVE-2025-64751 é uma vulnerabilidade ALTO (CVSS 8.8) que afeta github.com/openfga/openfga, helm charts (openfga), openfga (openfga).
- Chance de exploração nos próximos 30 dias (EPSS): 0.31%, maior que 24.3% das vulnerabilidades.
- Correção: atualize para 1.11.1, 0.2.49 ou posterior.
Description
Overview
OpenFGA v1.4.0 to v1.11.0 (openfga-0.1.34 <= Helm chart <= openfga-0.2.48, v.1.4.0 <= docker <= v.1.11.0) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed.
Am I Affected?
You are affected by this vulnerability if you meet the following preconditions:
- You are using OpenFGA v1.4.0 to v1.11.0
- The model has a a relation directly assignable by a type bound pubic access with condition
- The same relation is not assignable by a type bound public access without condition
- You have a type assigned for the same relation that is a type bound public access without condition
Fix
Upgrade to v1.11.1. This upgrade is backwards compatible.
Workaround
None
NVD description
OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.4.0 to v1.11.0 ( openfga-0.1.34 <= Helm chart <= openfga-0.2.48, v.1.4.0 <= docker <= v.1.11.0) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed. This issue has been patched in version 1.11.1.
Mais vulnerabilidades de github.com/openfga/openfga
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free