PT-2026-48462 · Openfga · Openfga

Published 2026-06-10 · Updated 2026-06-10 · CVE-2026-48096

NVD

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

OpenFGA is an authorization/permission engine built for developers. Prior to version 1.16.0, when iterator caching is enabled, two distinct check requests can produce the same cache key, leading to OpenFGA reusing an earlier cached result for a subsequent request. This issue has been patched in version 1.16.0.

Fix

Insufficient Verification of Data Authenticity

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-345

CWE-668

Related Identifiers

CVE-2026-48096

Affected Products

Openfga

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-48096 · Security Note
• https://github.com/openfga/openfga/releases/tag/v1.16.0 · Note
• https://github.com/openfga/openfga/security/advisories/GHSA-8396-jffm-qx4w · Note