CVE-2022-23542: OpenFGA Authorization Bypass
Published Dec 20, 2022
·Updated
OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. During an internal security assessment, it was discovered that OpenFGA version 0.3.0 is vulnerable to authorization bypass under certain conditions. This issue has been patched in version 0.3.1 and is backward compatible.
Affected Software
1 affected component
OPenFGA OPenFGA<0.3.1
Remediation
Patch Available
Event History
Dec 20, 2022
CVE Published
via MITRE·08:15 PM
Data Sourced
via MITRE·08:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-23542.
2
What is the severity of CVE-2022-23542?
The severity of CVE-2022-23542 is critical, with a CVSS score of 9.8.
3
What is OpenFGA?
OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar.
4
Which versions of OpenFGA are affected by this vulnerability?
OpenFGA version 0.3.0 is affected by this vulnerability.
5
How can I fix the vulnerability in OpenFGA?
The vulnerability in OpenFGA can be fixed by upgrading to version 0.3.1.