| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/openfga/openfga | ≥ 1.3.6, < 1.8.11 | 1.8.11 |
| helm charts | ≥ 0.1.36, < 0.2.29 | 0.2.29 |
| openfga | ≥ 1.3.6, < 1.8.11 | 1.8.11 |
Overview OpenFGA v1.8.10 or previous (Helm chart <= openfga-0.2.28, docker <= v.1.8.10) are vulnerable to authorization bypass when certain Check and ListObject calls are executed.
Am I Affected? If you are using OpenFGA v1.8.10 or previous, specifically under the following conditions, you are affected by this authorization bypass vulnerability:
Fix Upgrade to v1.8.11. This upgrade is backwards compatible.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free