What’s Vulnerable › Vulnerabilities

CVE-2025-64751: OpenFGA Improper Policy Enforcement

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-21 · updated 2026-10-19
• Weakness: CWE-285

Description

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.4.0 to v1.11.0 ( openfga-0.1.34 <= Helm chart <= openfga-0.2.48, v.1.4.0 <= docker <= v.1.11.0) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed. This issue has been patched in version 1.11.1.

Affected products

• openfga Helm Charts: from 0.1.34 before 0.2.49 — fixed in 0.2.49
• openfga: from 1.4.0 before 1.11.1 — fixed in 1.11.1

How to fix

Upgrade to a fixed version: openfga Helm Charts 0.2.49; openfga 1.11.1. Check the vendor advisory for mitigations.

References

• https://github.com/openfga/openfga/releases/tag/v1.11.1
• https://github.com/openfga/openfga/security/advisories/GHSA-2c64-vmv2-hgfc

Get alerted when CVE-2025-64751 or the next vulnerability affects your stack