要点
- CVE-2025-64751 是影响 github.com/openfga/openfga, helm charts (openfga), openfga (openfga) 的高危 (CVSS 8.8)漏洞。
- 未来 30 天内被利用的概率（EPSS）：0.31%，高于 24.3% 的漏洞。
- 修复：升级到 1.11.1, 0.2.49 或更高版本。
Description
Overview
OpenFGA v1.4.0 to v1.11.0 (openfga-0.1.34 <= Helm chart <= openfga-0.2.48, v.1.4.0 <= docker <= v.1.11.0) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed.
Am I Affected?
You are affected by this vulnerability if you meet the following preconditions:
- You are using OpenFGA v1.4.0 to v1.11.0
- The model has a a relation directly assignable by a type bound pubic access with condition
- The same relation is not assignable by a type bound public access without condition
- You have a type assigned for the same relation that is a type bound public access without condition
Fix
Upgrade to v1.11.1. This upgrade is backwards compatible.
Workaround
None
NVD description
OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.4.0 to v1.11.0 ( openfga-0.1.34 <= Helm chart <= openfga-0.2.48, v.1.4.0 <= docker <= v.1.11.0) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed. This issue has been patched in version 1.11.1.
github.com/openfga/openfga 的其他漏洞
查看全部 →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free