OpenFGA Improper Policy Enforcement Vulnerability Allowing Authorization Bypass

A vulnerability exists in OpenFGA versions 1.8.5 through 1.11.2, including specific Helm chart and Docker versions, allowing improper policy enforcement during certain Check calls. This issue arises in models with relations assignable by both type-bound public and non-public access, and can be exploited under specific conditions related to tuple assignments and object ID lexicography.

Impact

Exploitation of this vulnerability can lead to unauthorized access or permissions being granted, allowing users to bypass intended authorization policies.

Remediation

Users can upgrade to OpenFGA version 1.11.3, which is backwards compatible. This version is also available in the OpenFGA Helm chart version 0.2.52 and in the OpenFGA Docker image version 1.11.3.