netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish GHSA-c72g-53hw-82q7

Browse Source
This commit is contained in:
advisory-database[bot]
2025-06-10 20:34:44 +00:00
parent f5989a0402
commit c03d129f8d
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2025/05/GHSA-c72g-53hw-82q7/GHSA-c72g-53hw-82q7.json
+2 -2
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c72g-53hw-82q7",
"modified": "2025-05-28T19:47:26Z",
"modified": "2025-06-10T20:33:34Z",
"published": "2025-05-23T18:41:38Z",
"aliases": [
"CVE-2025-48371"
],
"summary": "OpenFGA Authorization Bypass",
"details": "### Overview\nOpenFGA v1.8.0 to v1.8.12 ( openfga-0.2.16 <= Helm chart <= openfga-0.2.30, v1.8.0 <= docker <= v.1.8.12) are vulnerable to authorization bypass when certain Check and ListObject calls are executed.\n\n\n### Am I Affected?\nIf you are using OpenFGA v1.8.0 to v1.8.12, specifically under the following conditions, you are affected by this authorization bypass vulnerability:\n- Calling Check API or ListObjects with an [authorization model](https://openfga.dev/docs/concepts#what-is-an-authorization-model) that has a relationship directly assignable by both [type bound public access](https://openfga.dev/docs/concepts#what-is-type-bound-public-access) and [userset](https://openfga.dev/docs/modeling/building-blocks/usersets), and\n- There are check or list object queries with [contextual tuples](https://openfga.dev/docs/interacting/contextual-tuples) for the relationship that can be directly assignable by both [type bound public access](https://openfga.dev/docs/concepts#what-is-type-bound-public-access) and [userset](https://openfga.dev/docs/modeling/building-blocks/usersets), and\n- Those contextual tuples’s user field is an userset, and\n- Type bound public access tuples are not assigned to the relationship\n\n### Fix\nUpgrade to v1.8.13. This upgrade is backwards compatible.\n\n### Acknowledgments\nOkta would like to thank @udyvish for discovering this vulnerability.",
"details": "### Overview\nOpenFGA v1.8.0 to v1.8.12 ( openfga-0.2.16 <= Helm chart <= openfga-0.2.31, v1.8.0 <= docker <= v.1.8.12) are vulnerable to authorization bypass when certain Check and ListObject calls are executed.\n\n\n### Am I Affected?\nIf you are using OpenFGA v1.8.0 to v1.8.12, specifically under the following conditions, you are affected by this authorization bypass vulnerability:\n- Calling Check API or ListObjects with an [authorization model](https://openfga.dev/docs/concepts#what-is-an-authorization-model) that has a relationship directly assignable by both [type bound public access](https://openfga.dev/docs/concepts#what-is-type-bound-public-access) and [userset](https://openfga.dev/docs/modeling/building-blocks/usersets), and\n- There are check or list object queries with [contextual tuples](https://openfga.dev/docs/interacting/contextual-tuples) for the relationship that can be directly assignable by both [type bound public access](https://openfga.dev/docs/concepts#what-is-type-bound-public-access) and [userset](https://openfga.dev/docs/modeling/building-blocks/usersets), and\n- Those contextual tuples’s user field is an userset, and\n- Type bound public access tuples are not assigned to the relationship\n\n### Fix\nUpgrade to v1.8.13. This upgrade is backwards compatible.\n\n### Acknowledgments\nOkta would like to thank @udyvish for discovering this vulnerability.",
"severity": [
{
"type": "CVSS_V4",