diff --git a/advisories/github-reviewed/2025/05/GHSA-c72g-53hw-82q7/GHSA-c72g-53hw-82q7.json b/advisories/github-reviewed/2025/05/GHSA-c72g-53hw-82q7/GHSA-c72g-53hw-82q7.json index f12a540e96d..3d17dc57246 100644 --- a/advisories/github-reviewed/2025/05/GHSA-c72g-53hw-82q7/GHSA-c72g-53hw-82q7.json +++ b/advisories/github-reviewed/2025/05/GHSA-c72g-53hw-82q7/GHSA-c72g-53hw-82q7.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-c72g-53hw-82q7", - "modified": "2025-05-28T19:47:26Z", + "modified": "2025-06-10T20:33:34Z", "published": "2025-05-23T18:41:38Z", "aliases": [ "CVE-2025-48371" ], "summary": "OpenFGA Authorization Bypass", - "details": "### Overview\nOpenFGA v1.8.0 to v1.8.12 ( openfga-0.2.16 <= Helm chart <= openfga-0.2.30, v1.8.0 <= docker <= v.1.8.12) are vulnerable to authorization bypass when certain Check and ListObject calls are executed.\n\n\n### Am I Affected?\nIf you are using OpenFGA v1.8.0 to v1.8.12, specifically under the following conditions, you are affected by this authorization bypass vulnerability:\n- Calling Check API or ListObjects with an [authorization model](https://openfga.dev/docs/concepts#what-is-an-authorization-model) that has a relationship directly assignable by both [type bound public access](https://openfga.dev/docs/concepts#what-is-type-bound-public-access) and [userset](https://openfga.dev/docs/modeling/building-blocks/usersets), and\n- There are check or list object queries with [contextual tuples](https://openfga.dev/docs/interacting/contextual-tuples) for the relationship that can be directly assignable by both [type bound public access](https://openfga.dev/docs/concepts#what-is-type-bound-public-access) and [userset](https://openfga.dev/docs/modeling/building-blocks/usersets), and\n- Those contextual tuples’s user field is an userset, and\n- Type bound public access tuples are not assigned to the relationship\n\n### Fix\nUpgrade to v1.8.13. This upgrade is backwards compatible.\n\n### Acknowledgments\nOkta would like to thank @udyvish for discovering this vulnerability.", + "details": "### Overview\nOpenFGA v1.8.0 to v1.8.12 ( openfga-0.2.16 <= Helm chart <= openfga-0.2.31, v1.8.0 <= docker <= v.1.8.12) are vulnerable to authorization bypass when certain Check and ListObject calls are executed.\n\n\n### Am I Affected?\nIf you are using OpenFGA v1.8.0 to v1.8.12, specifically under the following conditions, you are affected by this authorization bypass vulnerability:\n- Calling Check API or ListObjects with an [authorization model](https://openfga.dev/docs/concepts#what-is-an-authorization-model) that has a relationship directly assignable by both [type bound public access](https://openfga.dev/docs/concepts#what-is-type-bound-public-access) and [userset](https://openfga.dev/docs/modeling/building-blocks/usersets), and\n- There are check or list object queries with [contextual tuples](https://openfga.dev/docs/interacting/contextual-tuples) for the relationship that can be directly assignable by both [type bound public access](https://openfga.dev/docs/concepts#what-is-type-bound-public-access) and [userset](https://openfga.dev/docs/modeling/building-blocks/usersets), and\n- Those contextual tuples’s user field is an userset, and\n- Type bound public access tuples are not assigned to the relationship\n\n### Fix\nUpgrade to v1.8.13. This upgrade is backwards compatible.\n\n### Acknowledgments\nOkta would like to thank @udyvish for discovering this vulnerability.", "severity": [ { "type": "CVSS_V4",