CVE-2022-39341: OpenFGA Authorization Bypass

Q: What is CVE-2022-39341?

CVE-2022-39341 is a vulnerability in the OpenFGA authorization/permission engine that allows for authorization bypass under certain conditions.

Q: How severe is CVE-2022-39341?

CVE-2022-39341 has a severity rating of critical, with a CVSS score of 9.8.

Q: Which versions of OpenFGA are affected by CVE-2022-39341?

Versions of OpenFGA prior to version 0.2.4 are affected by CVE-2022-39341.

Q: How can I fix CVE-2022-39341?

To fix CVE-2022-39341, it is recommended to update to version 0.2.4 of OpenFGA, which contains a patch for this vulnerability.

Q: Where can I find more information about CVE-2022-39341?

More information about CVE-2022-39341 can be found in the references section of the vulnerability.

Published Oct 25, 2022

Updated

OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass under certain conditions. Users who have wildcard () defined on tupleset relations in their authorization model are vulnerable. Version 0.2.4 contains a patch for this issue.

Affected Software

1 affected component

OPenFGA OPenFGA<0.2.4

Remediation

Patch Available

https://github.com/openfga/openfga/commit/b466769cc100b2065047786578718d313f52695b

Event History

Oct 25, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2022-39341?

CVE-2022-39341 is a vulnerability in the OpenFGA authorization/permission engine that allows for authorization bypass under certain conditions.

How severe is CVE-2022-39341?