Vulnerabilities > CVE-2023-40579 - Unspecified vulnerability in Openfga

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

openfga

NVD

Published: 2023-08-25

Updated: 2024-11-21

Summary

OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. Some end users of OpenFGA v1.3.0 or earlier are vulnerable to authorization bypass when calling the ListObjects API. The vulnerability affects customers using `ListObjects` with specific models. The affected models contain expressions of type `rel1 from type1`. This issue has been patched in version 1.3.1.

Vulnerable Configurations

Part	Description	Count
Application	Openfga Openfga Openfga 0.0.1 Openfga Openfga 0.0.2 Openfga Openfga 0.1.0 Openfga Openfga 0.1.1 Openfga Openfga 0.1.2 Openfga Openfga 0.1.4 Openfga Openfga 0.1.5 Openfga Openfga 0.1.6 Openfga Openfga 0.1.7 Openfga Openfga 0.2.0 Openfga Openfga 0.2.1 Openfga Openfga 0.2.2 Openfga Openfga 0.2.3 Openfga Openfga 0.2.4 Openfga Openfga 0.2.5 Openfga Openfga 0.3.0 Openfga Openfga 0.3.1 Openfga Openfga 0.3.2 Openfga Openfga 0.3.3 Openfga Openfga 0.3.4 Openfga Openfga 0.3.5 Openfga Openfga 0.3.6 Openfga Openfga 0.3.7 Openfga Openfga 0.4.0 Openfga Openfga 0.4.1 Openfga Openfga 0.4.2 Openfga Openfga 0.4.3 Openfga Openfga 1.0.0 Openfga Openfga 1.0.1 Openfga Openfga 1.1.0 Openfga Openfga 1.1.1 Openfga Openfga 1.2.0 Openfga Openfga 1.3.0	36

Summary

Vulnerable Configurations

References