Overview
About vulnerability
Overview OpenFGA v1.8.4 or previous (Helm chart < openfga-0.2.22, docker < v.1.8.5) are vulnerable to authorization bypass when certain Check and ListObject calls are executed.
Am I Affected? If you are using OpenFGA v1.8.4 or previous, specifically under the following conditions, you are affected by this authorization bypass vulnerability:
- Calling Check API or ListObjects with a model that has a relation [directly assignable](https://openfga.dev/docs/concepts#what-is-a-directly-related-user-type) to both [public access](https://openfga.dev/docs/concepts#what-is-type-bound-public-access) AND [userset](https://openfga.dev/docs/concepts#what-is-a-user) with the [same type](https://openfga.dev/docs/concepts#what-is-a-type), and
- A type bound public access tuple is assigned to an object, and
- userset tuple is not assigned to the same object, and
- Check request’s user field is a userset that has the same type as the type bound public access tuple’s user type
Fix Upgrade to v1.8.5. This upgrade is backwards compatible.
Details
- Affected product:
- Grafana , github.com/openfga/openfga , openfga/openfga
- Affected packages:
- github.com/openfga/openfga @ 1.5.4 (+6 more)