CVE-2024-31452: OpenFGA Authorization Bypass

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-16 · updated 2026-06-17
Weakness: CWE-863

Description

OpenFGA is a high-performance and flexible authorization/permission engine. Some end users of OpenFGA v1.5.0 or later are vulnerable to authorization bypass when calling Check or ListObjects APIs. You are very likely affected if your model involves exclusion (e.g. `a but not b`) or intersection (e.g. `a and b`). This vulnerability is fixed in v1.5.3.

Affected products

openfga: from 1.5.0 before 1.5.3 — fixed in 1.5.3

How to fix

Upgrade to a fixed version: openfga 1.5.3. Check the vendor advisory for mitigations.

References

https://github.com/openfga/openfga/commit/b6a6d99b2bdbf8c3781503989576076289f48ed2
https://github.com/openfga/openfga/security/advisories/GHSA-8cph-m685-6v6r
https://github.com/openfga/openfga/commit/b6a6d99b2bdbf8c3781503989576076289f48ed2
https://github.com/openfga/openfga/security/advisories/GHSA-8cph-m685-6v6r

Get alerted when CVE-2024-31452 or the next vulnerability affects your stack