CVE-2022-23542
OpenFGA Authorization Bypass
OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. During an internal security assessment, it was discovered that OpenFGA version 0.3.0 is vulnerable to authorization bypass under certain conditions. This issue has been patched in version 0.3.1 and is backward compatible.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
OpenFGA Authorization Bypass
OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. During an internal security assessment, it was discovered that OpenFGA version 0.3.0 is vulnerable to authorization bypass under certain conditions. This issue has been patched in version 0.3.1 and is backward compatible.
- Record
CVE-2022-23542- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-285
- Updated
- 2026-11-02
EUVDEUVD-2022-7675
OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. During an internal security assessment, it was discovered that OpenFGA version 0.3.0 is vulnerable to authorization bypass under certain conditions. This issue has been patched in version 0.3.1 and is backward compatible.
- Record
EUVD-2022-7675- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-m3q4-7qmj-657m No score
OpenFGA Authorization Bypass
Overview
During our internal security assessment, it was discovered that OpenFGA versions v0.3.0 is vulnerable to authorization bypass under certain conditions.
Am I Affected?
You are affected by this vulnerability if all of the following applies:
- You are using OpenFGA v0.3.0
- You created a model using modeling language v1.1 that applies a type restriction to an object e.g.
define viewer: [user] - You created tuples based on the aforementioned model, e.g.
document:1#viewer@user:jon - You updated the previous model by adding a new type and replacing the previous restriction with the newly added type e.g.
define viewer: [employee] - You use the tuples created against the first model (step 3) and issue checks against the updated model e.g.
user=user:jon, relation=viewer, object:document:1
How to fix that?
Upgrade to version v0.3.1
Backward Compatibility
This update is backward compatible.
- Record
GHSA-m3q4-7qmj-657m- Weakness
- CWE-285
- Updated
- 2026-11-02
NVD
OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. During an internal security assessment, it was discovered that OpenFGA version 0.3.0 is vulnerable to authorization bypass under certain conditions. This issue has been patched in version 0.3.1 and is backward compatible.
- Record
CVE-2022-23542- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-285
- Updated
- 2026-11-02
OSV
OpenFGA Authorization Bypass
OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. During an internal security assessment, it was discovered that OpenFGA version 0.3.0 is vulnerable to authorization bypass under certain conditions. This issue has been patched in version 0.3.1 and is backward compatible.
- Record
CVE-2022-23542- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-285
- Updated
- 2026-11-02
OSVGHSA-m3q4-7qmj-657m No score
OpenFGA Authorization Bypass
Overview
During our internal security assessment, it was discovered that OpenFGA versions v0.3.0 is vulnerable to authorization bypass under certain conditions.
Am I Affected?
You are affected by this vulnerability if all of the following applies:
- You are using OpenFGA v0.3.0
- You created a model using modeling language v1.1 that applies a type restriction to an object e.g.
define viewer: [user] - You created tuples based on the aforementioned model, e.g.
document:1#viewer@user:jon - You updated the previous model by adding a new type and replacing the previous restriction with the newly added type e.g.
define viewer: [employee] - You use the tuples created against the first model (step 3) and issue checks against the updated model e.g.
user=user:jon, relation=viewer, object:document:1
How to fix that?
Upgrade to version v0.3.1
Backward Compatibility
This update is backward compatible.
- Record
GHSA-m3q4-7qmj-657m- Weakness
- CWE-285
- Updated
- 2026-11-02
OSVGO-2022-1179 No score
OpenFGA Authorization Bypass in github.com/openfga/openfga
OpenFGA Authorization Bypass in github.com/openfga/openfga
- Record
GO-2022-1179- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/openfga/openfgaGo |
0.3.0 to 0.3.0 | 0.3.1 |
github.com/openfga/openfgaGo |
0.3.0 up to 0.3.1 | 0.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-23542 is a high vulnerability (CVSS 7.7) in Openfga, published December 20, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.99%, the 62nd percentile. Fixed in github.com/openfga/openfga 0.3.1.
References
github.com/openfga/openfga/security/advisories/GHSA-m3q4-7qmj-657m
nvd.nist.gov/vuln/detail/CVE-2022-23542