CVE-2024-42473

CVSS V2 None CVSS V3 None

Description

OpenFGA is an authorization/permission engine. OpenFGA v1.5.7 and v1.5.8 are vulnerable to authorization bypass when calling Check API with a model that uses `but not` and `from` expressions and a userset. Users should downgrade to v1.5.6 as soon as possible. This downgrade is backward compatible. As of time of publication, a patch is not available but OpenFGA's maintainers are planning a patch for inclusion in a future release.

Overview

CVE ID
CVE-2024-42473

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2024-08-09T21:16:17.683Z

Last Modified Date
2024-08-09T21:16:17.683Z

Weakness Enumerations

CWE	URL
CWE-863	http://cwe.mitre.org/data/definitions/863.html

References

Reference URL	Reference Tags
https://github.com/openfga/openfga/security/advisories/GHSA-3f6g-m4hr-59h8	x_refsource_CONFIRM

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-42473
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42473

History

Created	Old Value	New Value	Data Type	Notes
2024-08-10 13:09:19				Added to TrackCVE