{"id":"CVE-2025-48371","aliases":["EUVD-2025-16351","GHSA-c72g-53hw-82q7","GO-2025-3707","openSUSE-SU-2025:15179-1"],"status":"published","title":"OpenFGA Authorization Bypass","description":"OpenFGA is an authorization/permission engine. OpenFGA versions 1.8.0 through 1.8.12 (corresponding to Helm chart openfga-0.2.16 through openfga-0.2.30 and docker 1.8.0 through 1.8.12) are vulnerable to authorization bypass when certain Check and ListObject calls are executed. Users are affected under four specific conditions: First, calling Check API or ListObjects with an authorization model that has a relationship directly assignable by both type bound public access and userset; second, there are check or list object queries with contextual tuples for the relationship that can be directly assignable by both type bound public access and userset; third, those contextual tuples’s user field is an userset; and finally, type bound public access tuples are not assigned to the relationship. Users should upgrade to version 1.8.13 to receive a patch. The upgrade is backwards compatible.","severity":{"version":"4.0","score":5.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00503,"percentile":0.43338,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-285"],"published":"2025-05-22T22:20:37Z","modified":"2026-10-28T02:30:45Z","fixes":[{"ecosystem":"Go","package":"github.com/openfga/openfga","fixed_in":["1.8.13"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/openfga/openfga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.0"},{"fixed":"1.8.13"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/openfga/openfga","ranges":[{"type":"SEMVER","events":[{"introduced":"1.8.0"},{"fixed":"1.8.13"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/openfga/openfga","ranges":[{"type":"SEMVER","events":[{"introduced":"1.8.0"},{"fixed":"1.8.13"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250527T204717-1.1"}]}],"bundled":4}],"products":[{"vendor":"openfga","product":"helm_charts"},{"vendor":"openfga","product":"openfga"}],"references":[{"url":"https://github.com/openfga/openfga/security/advisories/GHSA-c72g-53hw-82q7","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/openfga/openfga/commit/e5960d4eba92b723de8ff3a5346a07f50c1379ca","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48371","tags":["advisory"]},{"url":"https://pkg.go.dev/vuln/GO-2025-3707","tags":["web"]},{"url":"https://github.com/advisories/GHSA-c72g-53hw-82q7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48371.json","tags":["advisory"]},{"url":"https://github.com/openfga/openfga","tags":["package"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NUT27N46T3RCYUKKZDD2PQ3C7X7OURLR/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48371","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48374","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-48371","title":"OpenFGA Authorization Bypass","description":"OpenFGA is an authorization/permission engine. OpenFGA versions 1.8.0 through 1.8.12 (corresponding to Helm chart openfga-0.2.16 through openfga-0.2.30 and docker 1.8.0 through 1.8.12) are vulnerable to authorization bypass when certain Check and ListObject calls are executed. Users are affected under four specific conditions: First, calling Check API or ListObjects with an authorization model that has a relationship directly assignable by both type bound public access and userset; second, there are check or list object queries with contextual tuples for the relationship that can be directly assignable by both type bound public access and userset; third, those contextual tuples’s user field is an userset; and finally, type bound public access tuples are not assigned to the relationship. Users should upgrade to version 1.8.13 to receive a patch. The upgrade is backwards compatible.","status":"published","published":"2025-05-22T22:20:37.57Z","modified":"2025-05-23T14:14:20.586Z","cvss":[{"version":"4.0","score":5.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","level":"medium","assessor":"cna"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:32:41.41198Z"}],"euvd":[{"id":"EUVD-2025-16351","description":"OpenFGA is an authorization/permission engine. OpenFGA versions 1.8.0 through 1.8.12 (corresponding to Helm chart openfga-0.2.16 through openfga-0.2.30 and docker 1.8.0 through 1.8.12) are vulnerable to authorization bypass when certain Check and ListObject calls are executed. Users are affected under four specific conditions: First, calling Check API or ListObjects with an authorization model that has a relationship directly assignable by both type bound public access and userset; second, there are check or list object queries with contextual tuples for the relationship that can be directly assignable by both type bound public access and userset; third, those contextual tuples’s user field is an userset; and finally, type bound public access tuples are not assigned to the relationship. Users should upgrade to version 1.8.13 to receive a patch. The upgrade is backwards compatible.","status":"published","published":"2025-05-22T22:20:37Z","modified":"2025-05-23T14:14:20Z","cvss":[{"version":"4.0","score":5.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","level":"medium"}],"updated_at":"2026-11-02T20:32:39.383071Z"}],"ghsa":[{"id":"GHSA-c72g-53hw-82q7","title":"OpenFGA Authorization Bypass","description":"### Overview\nOpenFGA v1.8.0 to v1.8.12 ( openfga-0.2.16 \u003c= Helm chart \u003c= openfga-0.2.31, v1.8.0 \u003c= docker \u003c= v.1.8.12) are vulnerable to authorization bypass when certain Check and ListObject calls are executed.\n\n\n### Am I Affected?\nIf you are using OpenFGA v1.8.0 to v1.8.12, specifically under the following conditions, you are affected by this authorization bypass vulnerability:\n- Calling Check API or ListObjects with an [authorization model](https://openfga.dev/docs/concepts#what-is-an-authorization-model) that has a relationship directly assignable by both [type bound public access](https://openfga.dev/docs/concepts#what-is-type-bound-public-access) and [userset](https://openfga.dev/docs/modeling/building-blocks/usersets), and\n- There are check or list object queries with [contextual tuples](https://openfga.dev/docs/interacting/contextual-tuples) for the relationship that can be directly assignable by both [type bound public access](https://openfga.dev/docs/concepts#what-is-type-bound-public-access) and [userset](https://openfga.dev/docs/modeling/building-blocks/usersets), and\n- Those contextual tuples’s user field is an userset, and\n- Type bound public access tuples are not assigned to the relationship\n\n### Fix\nUpgrade to v1.8.13. This upgrade is backwards compatible.\n\n### Acknowledgments\nOpenFGA would like to thank @udyvish for discovering this vulnerability.","status":"published","published":"2025-05-23T18:41:38Z","modified":"2026-03-30T13:56:22Z","cvss":[{"version":"4.0","score":5.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","level":"medium"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:39:46.119458Z"}],"nvd":[{"id":"CVE-2025-48371","description":"OpenFGA is an authorization/permission engine. OpenFGA versions 1.8.0 through 1.8.12 (corresponding to Helm chart openfga-0.2.16 through openfga-0.2.30 and docker 1.8.0 through 1.8.12) are vulnerable to authorization bypass when certain Check and ListObject calls are executed. Users are affected under four specific conditions: First, calling Check API or ListObjects with an authorization model that has a relationship directly assignable by both type bound public access and userset; second, there are check or list object queries with contextual tuples for the relationship that can be directly assignable by both type bound public access and userset; third, those contextual tuples’s user field is an userset; and finally, type bound public access tuples are not assigned to the relationship. Users should upgrade to version 1.8.13 to receive a patch. The upgrade is backwards compatible.","status":"published","published":"2025-05-22T23:15:19.23Z","modified":"2026-06-17T09:29:33.787Z","cvss":[{"version":"4.0","score":5.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:11:09.562272Z"}],"osv":[{"id":"CVE-2025-48371","title":"OpenFGA Authorization Bypass","description":"OpenFGA is an authorization/permission engine. OpenFGA versions 1.8.0 through 1.8.12 (corresponding to Helm chart openfga-0.2.16 through openfga-0.2.30 and docker 1.8.0 through 1.8.12) are vulnerable to authorization bypass when certain Check and ListObject calls are executed. Users are affected under four specific conditions: First, calling Check API or ListObjects with an authorization model that has a relationship directly assignable by both type bound public access and userset; second, there are check or list object queries with contextual tuples for the relationship that can be directly assignable by both type bound public access and userset; third, those contextual tuples’s user field is an userset; and finally, type bound public access tuples are not assigned to the relationship. Users should upgrade to version 1.8.13 to receive a patch. The upgrade is backwards compatible.","status":"published","published":"2025-05-22T22:20:37.57Z","modified":"2026-10-28T02:30:45.261190866Z","cvss":[{"version":"4.0","score":5.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","level":"medium"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"GHSA-c72g-53hw-82q7","title":"OpenFGA Authorization Bypass","description":"### Overview\nOpenFGA v1.8.0 to v1.8.12 ( openfga-0.2.16 \u003c= Helm chart \u003c= openfga-0.2.31, v1.8.0 \u003c= docker \u003c= v.1.8.12) are vulnerable to authorization bypass when certain Check and ListObject calls are executed.\n\n\n### Am I Affected?\nIf you are using OpenFGA v1.8.0 to v1.8.12, specifically under the following conditions, you are affected by this authorization bypass vulnerability:\n- Calling Check API or ListObjects with an [authorization model](https://openfga.dev/docs/concepts#what-is-an-authorization-model) that has a relationship directly assignable by both [type bound public access](https://openfga.dev/docs/concepts#what-is-type-bound-public-access) and [userset](https://openfga.dev/docs/modeling/building-blocks/usersets), and\n- There are check or list object queries with [contextual tuples](https://openfga.dev/docs/interacting/contextual-tuples) for the relationship that can be directly assignable by both [type bound public access](https://openfga.dev/docs/concepts#what-is-type-bound-public-access) and [userset](https://openfga.dev/docs/modeling/building-blocks/usersets), and\n- Those contextual tuples’s user field is an userset, and\n- Type bound public access tuples are not assigned to the relationship\n\n### Fix\nUpgrade to v1.8.13. This upgrade is backwards compatible.\n\n### Acknowledgments\nOpenFGA would like to thank @udyvish for discovering this vulnerability.","status":"published","published":"2025-05-23T18:41:38Z","modified":"2026-09-10T03:50:24.481597446Z","cvss":[{"version":"4.0","score":5.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","level":"medium"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T15:46:44.571161Z"},{"id":"GO-2025-3707","title":"OpenFGA Authorization Bypass in github.com/openfga/openfga","description":"OpenFGA Authorization Bypass in github.com/openfga/openfga","status":"published","published":"2025-05-27T20:47:04Z","modified":"2026-02-04T04:15:19.418001Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2025:15179-1","title":"govulncheck-vulndb-0.0.20250527T204717-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250527T204717-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-30T00:00:00Z","modified":"2026-03-23T04:53:27.331108Z","updated_at":"2026-11-02T16:58:37.399567Z"}]}}