OpenFGA Improper Policy Enforcement Vulnerability in BatchCheck Operations

A vulnerability in OpenFGA versions 1.8.0 prior to 1.13.1 allows for improper policy enforcement during BatchCheck operations. This issue arises when multiple checks are sent for the same object, relation, and user combination, and the contexts of these checks differ in a specific way. Under these conditions, the authorization engine may not enforce policies correctly, potentially leading to unauthorized access or permissions.

Impact

Exploitation of this vulnerability can result in improper enforcement of authorization policies, allowing for potential unauthorized access or permissions.

Remediation

Users can upgrade to OpenFGA version 1.14.0 to address this vulnerability.