EUVD-2026-19486
GHSA-jwvj-g8pc-cx45
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. From 1.8.0 to 1.13.1, under specific conditions, BatchCheck calls with multiple checks sent for the same object, relation, and user combination can result in improper policy enforcement. This vulnerability is fixed in 1.14.0.
AnalysisAI
BatchCheck API calls in OpenFGA 1.8.0 through 1.13.1 can bypass authorization policies when multiple permission checks target the same object, relation, and user combination, allowing authenticated attackers with limited privileges to gain unauthorized access to protected resources. The vulnerability stems from improper handling of duplicate check parameters in batch operations and is fixed in version 1.14.0.
Technical ContextAI
OpenFGA is an authorization engine implementing a Zanzibar-inspired relationship-based access control (ReBAC) model. The vulnerability exists in the BatchCheck operation, which allows multiple authorization decisions to be evaluated in a single request. The root cause is classified under CWE-863 (Incorrect Authorization), indicating a flaw in the access control decision logic when processing batched requests with duplicate check parameters. When the same object-relation-user tuple appears multiple times within a single BatchCheck call, the authorization engine fails to properly enforce the defined policies, potentially returning incorrect permission decisions. This affects the core permission evaluation path in OpenFGA's authorization framework, which is critical infrastructure for applications delegating access control decisions to the platform.
RemediationAI
Vendor-released patch: OpenFGA 1.14.0 or later. Organizations using affected versions 1.8.0 through 1.13.1 must upgrade immediately to 1.14.0 or a later stable release to resolve the BatchCheck authorization bypass. No temporary workaround that avoids the vulnerability has been identified; immediate patching is the only remediation. Security advisory details are available at https://github.com/openfga/openfga/security/advisories/GHSA-jwvj-g8pc-cx45, which should be reviewed for comprehensive mitigation guidance and confirmation of fix applicability to your deployment.
OPenFGA is an open source authorization/permission engine built for developers. Rated high severity (CVSS 7.5), this vul
OpenFGA is an authorization/permission engine. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploi
OpenFGA is a high-performance and flexible authorization/permission engine. Rated critical severity (CVSS 9.8), this vul
OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. Rated critical sever
OpenFGA is a high-performance authorization/permission engine inspired by Google Zanzibar. Rated critical severity (CVSS
OpenFGA is an authorization/permission engine. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploi
OpenFGA is an authorization/permission engine. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploi
Improper policy enforcement in OpenFGA versions 1.8.5 through 1.11.2 (and corresponding Helm Chart and Docker releases)
OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Rated high s
OpenFGA 0.1.4 through 1.13.1 discloses preshared API authentication keys in plaintext HTML responses from the unauthenti
OpenFGA, an authorization/permission engine, is vulnerable to a denial of service attack in versions prior to 1.4.3. Rat
OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. Rated medium severit
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today