OpenFGA Caching Vulnerability Leading to Improper Policy Enforcement

A vulnerability in OpenFGA prior to version 1.14.1 allows models with condition-based relations and caching enabled to produce identical cache keys for different check requests. This could lead to the unintended reuse of cached results, causing incorrect authorization decisions. The issue arises when models rely on condition evaluation and caching is active.

Impact

Exploitation of this vulnerability could result in improper policy enforcement, where cached authorization results are incorrectly reused, potentially allowing unauthorized actions or access.

Remediation

Users can upgrade to OpenFGA version 1.14.1 to address this vulnerability. The updated version is available on the OpenFGA GitHub Releases page.