PT-2025-18316 · Openfga · Openfga

Avinashs433 · Publicado 2025-04-30 · Atualizado 2025-05-20 · CVE-2025-46331

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenFGA versions 1.3.6 through 1.8.10

Description OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. The issue concerns an authorization bypass when certain Check and ListObject calls are executed. This problem has been corrected in version 1.8.11.

Recommendations For versions 1.3.6 through 1.8.10, update to version 1.8.11 to resolve the issue.

Exploit

Correção

Improper Access Control

Incorrect Authorization

Enumeração de Fraquezas

CWE-284

CWE-863

Identificadores relacionados

CVE-2025-46331

ECHO-3774-CD30-2AE0

GHSA-W222-M46C-MGH6

GO-2025-3657

OPENSUSE-SU-2025:15135-1

Produtos afetados

Openfga

Referências · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46331.json · Exploit
• https://github.com/openfga/openfga · Nota
• https://github.com/openfga/openfga/security/advisories/GHSA-w222-m46c-mgh6 · Aviso do Fabricante
• https://github.com/openfga/openfga/commit/244302e7a8b979d66cc1874a3899cdff7d47862f · Correção
• https://twitter.com/VulmonFeeds/status/1917765991154561149 · Publicação no Twitter
• https://suse.com/security/cve/CVE-2025-3931 · Nota
• https://suse.com/security/cve/CVE-2025-46721 · Nota
• https://suse.com/security/cve/CVE-2024-52290 · Nota
• https://suse.com/security/cve/CVE-2025-46331 · Nota
• https://suse.com/security/cve/CVE-2025-4432 · Nota
• https://lists.opensuse.org/archives/list/[e-mail]/thread/QOPKRPL75SZMLT3YSQAZEDWH7RBRXGJK · Nota
• https://osv.dev/vulnerability/CVE-2025-46331 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2025-46735 · Nota
• https://suse.com/security/cve/CVE-2025-46816 · Nota
• https://suse.com/security/cve/CVE-2024-8063 · Nota