PT-2026-6646 · Openfga · Openfga

Adriantam · Published 2026-02-05 · Updated 2026-03-03 · CVE-2026-24851

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenFGA versions 1.8.5 through 1.11.2

Description OpenFGA is an authorization/permission engine. Versions 1.8.5 through 1.11.2 are susceptible to improper policy enforcement during specific Check calls. This occurs when a model includes a relation directly assignable by a type bound public access and assignable by type bound non-public access, a tuple assigned for the relation that is a type bound public access, a tuple assigned for the same object with the same relation that is not type bound public access, and a tuple assigned for a different object that has an object ID lexicographically larger with the same user and relation which is not type bound public access.

Recommendations Upgrade to version 1.11.3.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-24851

GHSA-JQ9F-GM9W-RWM9

GO-2026-4446

SUSE-SU-2026:0757-1

Affected Products

Openfga

References · 116

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24851.json · Exploit
• https://github.com/openfga/openfga/security/advisories/GHSA-jq9f-gm9w-rwm9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24851 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24851 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jq9f-gm9w-rwm9 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4446 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://github.com/openfga/openfga · Note
• https://github.com/openfga/openfga/releases/tag/v1.11.3 · Note
• https://github.com/openfga/openfga/commit/1bb5eddf4a3d2fc718aab7914b8f9a1200d2f7ee · Note
• https://suse.com/security/cve/CVE-2026-25890 · Note
• https://suse.com/security/cve/CVE-2026-26205 · Note
• https://suse.com/security/cve/CVE-2026-25882 · Note
• https://suse.com/security/cve/CVE-2026-27571 · Note
• https://suse.com/security/cve/CVE-2026-23644 · Note