8.1
High
CVE-2024-31452 OpenFGA is a high-performance and flexible authorization/permission engine
Description
OpenFGA is a high-performance and flexible authorization/permission engine. Some end users of OpenFGA v1.5.0 or later are vulnerable to authorization bypass when calling Check or ListObjects APIs. You are very likely affected if your model involves exclusion (e.g. `a but not b`) or intersection (e.g. `a and b`). This vulnerability is fixed in v1.5.3.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| openfga 1.5 | 1.5.0 → < 1.5.3 | 1.5.3 |
Other CVEs of openfga
The 27 CVEs of openfga →
CVE-2026-61709
OpenFGA is an authorization and permission engine built for developers
5.3
Medium
CVE-2026-55689
OpenFGA is an authorization/permission engine built for developers
6.8
Medium
CVE-2026-55170
OpenFGA is an authorization/permission engine built for developers
2.1
Low
CVE-2026-48096
OpenFGA is an authorization/permission engine built for developers
5.0
Medium