CVE-2022-23542

OpenFGA Authorization Bypass

State: Published
Severity: 7.7 High
Published: Dec 20, 2022
Updated: Apr 16, 2025
Reserved: Jan 19, 2022

Description

OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. During an internal security assessment, it was discovered that OpenFGA version 0.3.0 is vulnerable to authorization bypass under certain conditions. This issue has been patched in version 0.3.1 and is backward compatible.

Scores

CVSS	Score	Vector	Source
3.1	7.7 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L	GitHub_M

Weaknesses

CWE-285 Improper Authorization

Affected Products

Product	Versions
openfgaopenfga	= 0.3.0Affected

References

https://github.com/openfga/openfga/security/advisories/GHSA-m3q4-7qmj-657m
https://github.com/openfga/openfga/pull/422
https://github.com/openfga/openfga/releases/tag/v0.3.1

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.