What’s Vulnerable › Vulnerabilities

CVE-2025-55213: OpenFGA Authorization Bypass (Check)

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-08-18 · updated 2026-06-17
• Weakness: CWE-863

Description

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.9.3 to v1.9.4 ( openfga-0.2.40 <= Helm chart <= openfga-0.2.41, v1.9.3 <= docker <= v.1.9.4) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed. This vulnerability is fixed in 1.9.5.

Affected products

• openfga Helm Charts: from 0.2.40 before 0.2.42 — fixed in 0.2.42
• openfga: from 1.9.3 before 1.9.5 — fixed in 1.9.5

How to fix

Upgrade to a fixed version: openfga Helm Charts 0.2.42; openfga 1.9.5. Check the vendor advisory for mitigations.

References

• https://github.com/openfga/openfga/commit/1a7e0e37fc4777c824b2386cac4867a66f3480b0
• https://github.com/openfga/openfga/security/advisories/GHSA-mgh9-4mwp-fg55

Get alerted when CVE-2025-55213 or the next vulnerability affects your stack