PT-2025-18316 · Openfga · Openfga

Avinashs433 · Published 2025-04-30 · Updated 2025-05-20 · CVE-2025-46331

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenFGA versions 1.3.6 through 1.8.10

Description OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. The issue concerns an authorization bypass when certain Check and ListObject calls are executed. This problem has been corrected in version 1.8.11.

Recommendations For versions 1.3.6 through 1.8.10, update to version 1.8.11 to resolve the issue.

Exploit

Fix

Incorrect Authorization

Improper Access Control

Weakness Enumeration

CWE-863

CWE-284

Related Identifiers

CVE-2025-46331

ECHO-3774-CD30-2AE0

GHSA-W222-M46C-MGH6

GO-2025-3657

OPENSUSE-SU-2025:15135-1

Affected Products

Openfga

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46331.json · Exploit
• https://github.com/openfga/openfga/security/advisories/GHSA-w222-m46c-mgh6 · Vendor Advisory
• https://github.com/openfga/openfga/commit/244302e7a8b979d66cc1874a3899cdff7d47862f · Patch
• https://osv.dev/vulnerability/CVE-2025-46331 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3657 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w222-m46c-mgh6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46331 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15135-1 · Vendor Advisory
• https://github.com/openfga/openfga · Note
• https://suse.com/security/cve/CVE-2025-46815 · Note
• https://suse.com/security/cve/CVE-2025-4658 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/QOPKRPL75SZMLT3YSQAZEDWH7RBRXGJK · Note
• https://suse.com/security/cve/CVE-2025-3757 · Note
• https://suse.com/security/cve/CVE-2024-52290 · Note
• https://suse.com/security/cve/CVE-2025-4432 · Note